CVE-2010-0025

Microsoft Windows and Exchange Server - Unauthorized Email Content Exposure via SMTP Memory Allocation

Title source: llm
STIX 2.1

Description

The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2000 SP3, does not properly allocate memory for SMTP command replies, which allows remote attackers to read fragments of e-mail messages by sending a series of invalid commands and then sending a STARTTLS command, aka "SMTP Memory Allocation Vulnerability."

References (4)

Core 4
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/39253
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-024
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA10-103A.html

Scores

EPSS 0.2149
EPSS Percentile 97.3%

Details

CWE
CWE-200
Status published
Products (9)
microsoft/exchange_server 2000 sp3
microsoft/exchange_server 2003 sp2
microsoft/exchange_server 2007 sp1 (2 CPE variants)
microsoft/exchange_server 2010
microsoft/windows_2000
microsoft/windows_2003_server
microsoft/windows_server_2003
microsoft/windows_server_2008 (5 CPE variants)
microsoft/windows_xp (3 CPE variants)
Published Apr 14, 2010
Tracked Since Feb 18, 2026