Microsoft Vista Spoofed LLTD HELLO Packet Security Restriction Bypass Vulnerability

Bugtraq ID:	23279
Class:	Input Validation Error
CVE:	CVE-2007-1527
Remote:	Yes
Local:	No
Published:	Apr 02 2007 12:00AM
Updated:	Apr 04 2007 08:52PM
Credit:	Ollie Whitehouse discovered this vulnerability.
Vulnerable:	Microsoft Windows Vista December CTP Microsoft Windows Vista Ultimate Microsoft Windows Vista Home Premium Microsoft Windows Vista Home Basic Microsoft Windows Vista Enterprise Microsoft Windows Vista Business Microsoft Windows Vista beta 2 Microsoft Windows Vista Beta 1 Microsoft Windows Vista Beta Microsoft Windows Vista 0
Not Vulnerable:

Microsoft Vista Spoofed LLTD HELLO Packet Security Restriction Bypass Vulnerability

The Microsoft Windows Vista operating system is prone to a security-restriction-bypass vulnerability because the software fails to properly sanitize user-supplied packet-level data.

Attackers can exploit this issue to bypass the security restrictions and gain unauthorized access to restricted sites. This may allow attackers to bypass the security restrictions enforced by the Vista operating system.

Microsoft Vista Spoofed LLTD HELLO Packet Security Restriction Bypass Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Microsoft Vista Spoofed LLTD HELLO Packet Security Restriction Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Microsoft Vista Spoofed LLTD HELLO Packet Security Restriction Bypass Vulnerability

References:

• Microsoft Windows Homepage (Microsoft)
  
• Windows Vista Network Attack Surface Analysis (Symantec)