Actively exploited · Published Jun 16, 2011 · Assigned by microsoft

CVE-2011-1889

Critical 9.8 Exploited

In plain English

A critical-severity memory corruption in Forefront Threat Management Gateway (TMG) from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 49.0% (higher than 99% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)49.0%top 1.1% of all CVEs

Exploited in the wildYesCISA KEV since Mar 3, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 24, 2022.

Official description

The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability."

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

1025637 vdb-entry, x_refsource_SECTRACK
MS11-040 vendor-advisory, x_refsource_MS
ms-tmg-firewall-bo(67736) vdb-entry, x_refsource_XF
48181 vdb-entry, x_refsource_BID
44857 third-party-advisory, x_refsource_SECUNIA
oval:org.mitre.oval:def:12642 vdb-entry, signature, x_refsource_OVAL
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-1889 government-resource