CVE-2010-0239

published 2010-02-10

CVE-2010-0239: The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properly perform bounds…

Priority P2 73 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properly perform bounds checking on ICMPv6 Router Advertisement packets, which allows remote attackers to execute arbitrary code via crafted packets, aka "ICMPv6 Router Advertisement Vulnerability."

Detection & IOCs extracted from sources · hover to see the quote

command pkt = IPv6(dst=v6_dst, hlim=255) / IPv6ExtHdrFragment() / ICMPv6ND_RA() / ICMPv6NDOptPrefixInfo(len=255, prefixlen=64, prefix="2001::") / Raw(load='A'*2008)↗

• → Detect oversized/malformed ICMPv6 Router Advertisement packets with ICMPv6NDOptPrefixInfo option length field set to 255 (anomalous), which is the exploit trigger for the bounds-check bypass. ↗
• → Detect fragmented ICMPv6 Router Advertisement packets (IPv6 Fragment Extension Header present on an RA message) — the exploit deliberately fragments the malicious RA across 1500-byte fragments. ↗
• → Detect ICMPv6 Router Advertisement packets carrying an anomalously large payload (~2008 bytes of padding), far exceeding normal RA option sizes, indicative of a heap/stack overflow attempt. ↗
• → Scope detection to Windows Vista Gold/SP1/SP2 and Server 2008 Gold/SP2 hosts with IPv6 enabled — the vulnerability only exists when IPv6 is active on the interface. ↗
• → Successful exploitation grants SYSTEM-level privileges; monitor for unexpected SYSTEM-context process spawning following receipt of anomalous ICMPv6 RA traffic. ↗

• · The vulnerability is only exploitable when IPv6 is enabled on the target host. Disabling IPv6 eliminates the attack surface entirely. ↗
• · Failed exploit attempts manifest as denial-of-service (system crash/BSOD) rather than code execution, so DoS-only outcomes should still be treated as active exploitation attempts. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94