A vulnerability, which was classified as critical, has been found in Microsoft Windows 7/Server 2008 R2 (Operating System). Affected by this issue is some unknown functionality of the component DHCPv6 Message Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability.

The weakness was presented 11/13/2012 as 2763523 as not defined knowledge base article (Website). The advisory is available at support.microsoft.com. The public release was coordinated in cooperation with the vendor. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

After immediately, there has been an exploit disclosed. It is declared as proof-of-concept. As 0-day the estimated underground price was around $5k-$25k.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at support.microsoft.com. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7
• Server 2008 R2

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion