MS.IAS.Privilege.Elevation

Release Date Dec 08, 2009
Severity critical
Impact Unauthenticated Privilege Escalation: Remote attackers can leverage their privilege on the vulnerable systems.
Description This indicates an attack attempt against a privilege elevation vulnerability in EAP-MSCHAPv2 authentication used in VPN tunnel protocols or 802.1x authentication.
Affected Products Microsoft Internet Authentication Service in following systems: Microsoft Windows 2000 Service Pack 4 Windows XP Service Pack 2 and Windows XP Service Pack 3 Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Windows Vista and Windows Vista Service Pack 1 Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1 Windows Server 2008 for 32-bit Systems Windows Server 2008 for x64-based Systems Windows Server 2008 for Itanium-based Systems
Recommended Actions Apply patch, available from the web site: http://www.microsoft.com/technet/security/Bulletin/ms09-071.mspx
Coverage IPS VCM
Common Vulnerabilities and Exposures (CVE) CVE-2009-3677
Reference/s http://technet.microsoft.com/en-us/security/bulletin/ms09-071.mspx (MS-ID)

Fortinet