Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability

The remote Windows host is missing security update 5020005. It is, therefore, affected by multiple vulnerabilities

  - AMD: CVE-2022-23824 IBPB and Return Address Predictor Interactions (CVE-2022-23824)

  - Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability (CVE-2022-37966)

  - Windows Kerberos Elevation of Privilege Vulnerability (CVE-2022-37967)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5020013. It is, therefore, affected by multiple vulnerabilities

  - Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability (CVE-2022-41090, CVE-2022-41116)

  - AMD: CVE-2022-23824 IBPB and Return Address Predictor Interactions (CVE-2022-23824)

  - Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability (CVE-2022-37966)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
167118	KB5020005: Windows Server 2008 Security Update (November 2022)	Nessus	Windows : Microsoft Bulletins	high
167103	KB5020013: Windows Server 2008 R2 Security Update (November 2022)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2022-41044

high

Tenable Plugins

high

high