{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-04-14T00:00:00", "descriptions": [{"lang": "en", "value": "The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka \"Web Proxy TCP State Limited Denial of Service Vulnerability.\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-12T19:57:01", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"name": "1022045", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1022045"}, {"name": "MS09-016", "tags": ["vendor-advisory", "x_refsource_MS"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-016"}, {"name": "53636", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/53636"}, {"name": "TA09-104A", "tags": ["third-party-advisory", "x_refsource_CERT"], "url": "http://www.us-cert.gov/cas/techalerts/TA09-104A.html"}, {"name": "ADV-2009-1030", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/1030"}, {"name": "34687", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/34687"}, {"name": "oval:org.mitre.oval:def:6068", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6068"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "ID": "CVE-2009-0077", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka \"Web Proxy TCP State Limited Denial of Service Vulnerability.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "1022045", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1022045"}, {"name": "MS09-016", "refsource": "MS", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-016"}, {"name": "53636", "refsource": "OSVDB", "url": "http://osvdb.org/53636"}, {"name": "TA09-104A", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA09-104A.html"}, {"name": "ADV-2009-1030", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/1030"}, {"name": "34687", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/34687"}, {"name": "oval:org.mitre.oval:def:6068", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6068"}]}}}}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2009-0077", "datePublished": "2009-04-15T03:49:00", "dateReserved": "2009-01-08T00:00:00", "dateUpdated": "2018-10-12T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:forefront_threat_management_gateway:-:-:medium_business:*:*:*:*:*", "matchCriteriaId": "034CCD4A-9B8D-466F-AEE7-82D25613BA67", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2004:sp3:enterprise:*:*:*:*:*", "matchCriteriaId": "234D43DB-0FC3-4B94-8883-EEE99A427E69", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2004:sp3:standard:*:*:*:*:*", "matchCriteriaId": "64ACA6AB-44C3-4B33-BEA1-04DFF004FA7D", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2006:sp1:*:*:*:*:*:*", "matchCriteriaId": "62CDCE9A-440C-4268-9430-BCD5E79D6ABD", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2006:supportability:*:*:*:*:*:*", "matchCriteriaId": "9171409D-53E1-472B-A8E8-A3471C4F3BC5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka \"Web Proxy TCP State Limited Denial of Service Vulnerability.\""}, {"lang": "es", "value": "El motor del cortafuegos en Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); e Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, y 2006 SP1; no gestiona adecuadamente el estado de sesi\u00f3n de los oyentes web, lo que permite a atacantes remotos provocar una denegaci\u00f3n de servicio (muchas sesiones caducadas)a trav\u00e9s de paquetes manipulados, tambi\u00e9n conocido como \"Vulnerabilidad de denegaci\u00f3n de servicio de limitada por el estado TCP del Web Proxy\"."}], "id": "CVE-2009-0077", "lastModified": "2018-10-12T21:49:23.657", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-04-15T08:00:00.267", "references": [{"source": "secure@microsoft.com", "url": "http://osvdb.org/53636"}, {"source": "secure@microsoft.com", "url": "http://secunia.com/advisories/34687"}, {"source": "secure@microsoft.com", "url": "http://www.securitytracker.com/id?1022045"}, {"source": "secure@microsoft.com", "tags": ["US Government Resource"], "url": "http://www.us-cert.gov/cas/techalerts/TA09-104A.html"}, {"source": "secure@microsoft.com", "url": "http://www.vupen.com/english/advisories/2009/1030"}, {"source": "secure@microsoft.com", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-016"}, {"source": "secure@microsoft.com", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6068"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}