CVE-2010-1690 : The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and

The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and earlier, Windows Server 2008 R2, Exchange Server 2003 SP3 and earlier, Exchange Server 2007 SP2 and earlier, and Exchange Server 2010 does not verify that transaction IDs of responses match transaction IDs of queries, which makes it easier for man-in-the-middle attackers to spoof DNS responses, a different vulnerability than CVE-2010-0024 and CVE-2010-0025.

Published 2010-05-07 18:30:02

Updated 2020-04-09 13:25:26

Source MITRE

View at NVD, CVE.org

Vulnerability category: Input validation

Threat overview for CVE-2010-1690

Top countries where our scanners detected CVE-2010-1690

Top open port discovered on systems with this issue 80

IPs affected by CVE-2010-1690 2,732

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2010-1690!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2010-1690

Probability of exploitation activity in the next 30 days: 1.46%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 86 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2010-1690

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:P	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2010-1690

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2010-1690

http://www.coresecurity.com/content/CORE-2010-0424-windows-smtp-dns-query-id-bugs

Windows SMTP Service DNS query Id vulnerabilities | Core Security
Third Party Advisory

CVEs referencing this url
http://securitytracker.com/id?1023939

Windows SMTP Service Uses Predictable Transaction IDs and Fails to Validate Response IDs Which May Permit DNS Spoofing - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0058.html

Broken Link

CVEs referencing this url
http://www.securityfocus.com/bid/39910

Microsoft Windows SMTP Server DNS Response Field Validation DNS Spoofing Vulnerability
Patch;Third Party Advisory;VDB Entry

Products affected by CVE-2010-1690