This host is missing a critical security update according to Microsoft Bulletin MS10-009.

Successful exploitation will allow remote attackers to execute arbitrary code with system privileges. Failed exploit attempts will likely result in denial-of-service conditions. Impact Level: System/Application

Run Windows Update and update the listed hotfixes or download and update mentioned hotfixes in the advisory from the below link, http://www.microsoft.com/technet/security/bulletin/ms10-009.mspx

The flaws are due to Windows TCP/IP stack, - not performing the appropriate level of bounds checking on specially crafted 'ICMPv6' Router Advertisement packets. - fails to properly handle malformed Encapsulating Security Payloads (ESP) over UDP datagram fragments while running a custom network driver that splits the UDP header into multiple MDLs, which could be exploited by remote attackers to execute arbitrary code by sending specially crafted IP datagram fragments to a vulnerable system. - not performing the appropriate level of bounds checking on specially crafted ICMPv6 Route Information packets, which could be exploited by remote attackers to execute arbitrary code by sending specially crafted ICMPv6 packets to a vulnerable system. - not properly handling TCP packets with a malformed selective acknowledgment (SACK) value.

Microsoft Windows Vista Service Pack 1/2 and prior. Microsoft Windows Server 2008 Service Pack 1/2 and prior.

• http://secunia.com/advisories/38506/
• http://www.microsoft.com/technet/security/bulletin/ms10-009.mspx
• http://www.vupen.com/english/advisories/2010/0342

---

Updated on 2015-03-25