Signature Detail

HTTP: Active Directory Federation Services Malicious Header Remote Code Execution

This signature detects attempts to exploit a known vulnerability against Active Directory Federation Services. A successful attack can lead to arbitrary remote code execution within the context of the affected application.

Extended Description

Microsoft Active Directory Federation Services (ADFS) is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the application, which may aid in further attacks.

Affected Products

• Microsoft windows_server 2008 R2
• Microsoft windows_server_2003 SP1
• Microsoft windows_server_2003 SP2
• Microsoft windows_server_2003_datacenter_edition SP1
• Microsoft windows_server_2003_datacenter_edition
• Microsoft windows_server_2003_datacenter_x64_edition SP2
• Microsoft windows_server_2003_datacenter_x64_edition
• Microsoft windows_server_2003_enterprise_edition SP1
• Microsoft windows_server_2003_enterprise_edition
• Microsoft windows_server_2003_enterprise_x64_edition SP2
• Microsoft windows_server_2003_enterprise_x64_edition
• Microsoft windows_server_2003_standard_edition SP1
• Microsoft windows_server_2003_standard_edition SP2
• Microsoft windows_server_2003_standard_edition
• Microsoft windows_server_2003_standard_x64_edition
• Microsoft windows_server_2003_web_edition SP1
• Microsoft windows_server_2003_web_edition SP2
• Microsoft windows_server_2003_web_edition
• Microsoft windows_server_2003_x64 SP1
• Microsoft windows_server_2003_x64 SP2
• Microsoft windows_server_2008 SP2 Beta
• Microsoft windows_server_2008_datacenter_edition SP2
• Microsoft windows_server_2008_datacenter_edition
• Microsoft windows_server_2008_enterprise_edition SP2
• Microsoft windows_server_2008_enterprise_edition
• Microsoft windows_server_2008_for_32-bit_systems SP2
• Microsoft windows_server_2008_for_32-bit_systems
• Microsoft windows_server_2008_for_x64-based_systems R2
• Microsoft windows_server_2008_for_x64-based_systems SP2
• Microsoft windows_server_2008_for_x64-based_systems
• Microsoft windows_server_2008_r2_datacenter
• Microsoft windows_server_2008_standard_edition SP2
• Microsoft windows_server_2008_standard_edition

References

• BugTraq: 37214
• CVE: CVE-2009-2509