Test ID:	1.3.6.1.4.1.25623.1.0.901064
Category:	Windows : Microsoft Bulletins
Title:	Microsoft Windows ADFS Remote Code Execution Vulnerability (971726)
Summary:	This host is missing a critical security update according to; Microsoft Bulletin MS09-070.
Description:	Summary: This host is missing a critical security update according to Microsoft Bulletin MS09-070. Vulnerability Insight: The vulnerability is due to incorrect validation of request headers when an authenticated user connects to an ADFS enabled Web Server. An attacker who successfully exploited this vulnerability could take complete control of an affected system. Vulnerability Impact: Successful exploitation will allow remote attackers to take complete control of the victim's system. Affected Software/OS: - Microsoft Windows 2K3 Service Pack 2 and prior - Microsoft Windows Server 2008 Service Pack 2 and prior Solution: The vendor has released updates. Please see the references for more information. CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-2508 Cert/CC Advisory: TA09-342A http://www.us-cert.gov/cas/techalerts/TA09-342A.html Microsoft Security Bulletin: MS09-070 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-070 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5882 Common Vulnerability Exposure (CVE) ID: CVE-2009-2509 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6441
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.