CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
5.3 | $0-$5k | 0.00 |
A vulnerability, which was classified as problematic, has been found in Microsoft Windows Server 2008 (Operating System). This issue affects some unknown processing of the component Hyper-V VMBus. The manipulation with an unknown input leads to a resource management vulnerability. Using CWE to declare the problem leads to CWE-399. Impacted is availability. The summary by CVE is:
Hyper-V in Microsoft Windows Server 2008 Gold, SP2, R2, and R2 SP1 allows guest OS users to cause a denial of service (host OS infinite loop) via malformed machine instructions in a VMBus packet, aka "VMBus Persistent DoS Vulnerability."
The weakness was disclosed 06/14/2011 by Nicolas Economou with Core Security Technologies as MS11-047 (Website). It is possible to read the advisory at coresecurity.com. The identification of this vulnerability is CVE-2011-1872 since 05/04/2011. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available.
A public exploit has been developed by Core Security in ANSI C and been published immediately after the advisory. The exploit is available at securityfocus.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 55127 (MS11-047: Vulnerability in Hyper-V Could Allow Denial of Service (2525835)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows : Microsoft Bulletins and running in the context l.
Upgrading eliminates this vulnerability. Applying the patch MS11-047 is able to eliminate this problem. The bugfix is ready for download at microsoft.com. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published immediately after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at X-Force (67731), Tenable (55127) and Exploit-DB (17401). The entry 4228 is pretty similar.
Product
Type
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.9VulDB Meta Temp Score: 5.3
VulDB Base Score: 5.9
VulDB Temp Score: 5.3
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Resource managementCWE: CWE-399 / CWE-404
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Author: Core Security
Programming Language: 🔍
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 55127
Nessus Name: MS11-047: Vulnerability in Hyper-V Could Allow Denial of Service (2525835)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
Exploit-DB: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Exploit Delay Time: 🔍
Patch: MS11-047
Timeline
05/04/2011 🔍06/14/2011 🔍
06/14/2011 🔍
06/14/2011 🔍
06/14/2011 🔍
06/14/2011 🔍
06/14/2011 🔍
06/14/2011 🔍
06/14/2011 🔍
06/15/2011 🔍
06/15/2011 🔍
06/16/2011 🔍
06/20/2011 🔍
03/19/2021 🔍
Sources
Vendor: microsoft.comProduct: microsoft.com
Advisory: MS11-047
Researcher: Nicolas Economou
Organization: Core Security Technologies
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2011-1872 (🔍)
OVAL: 🔍
IAVM: 🔍
X-Force: 67731
SecurityTracker: 1025644 - Microsoft Hyper-V VMBus Packet Validation Flaw Lets Local Users Deny Service
Vulnerability Center: 31779 - [MS11-047] Microsoft Hyper-V on Windows Server 2008 Local Denial of Service Vulnerability, Medium
SecurityFocus: 48179 - Microsoft Hyper-V VMBus CVE-2011-1872 Denial of Service Vulnerability
Secunia: 44908 - Microsoft Windows Hyper-V VMBus Denial of Service Vulnerability, Less Critical
scip Labs: https://www.scip.ch/en/?labs.20140213
See also: 🔍
Entry
Created: 06/20/2011 02:00Updated: 03/19/2021 11:21
Changes: 06/20/2011 02:00 (83), 04/07/2017 12:38 (18), 03/19/2021 11:21 (2)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.