CVE-2009-0077
The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition ...
The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka "Web Proxy TCP State Limited Denial of Service Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka "Web Proxy TCP State Limited Denial of Service Vulnerability."
- Record
CVE-2009-0077- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka "Web Proxy TCP State Limited Denial of Service Vulnerability."
- Record
CVE-2009-0077- Updated
- 2026-11-02
EUVDEUVD-2009-0086 No score
The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka "Web Proxy TCP State Limited Denial of Service Vulnerability."
- Record
EUVD-2009-0086- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9rc2-2223-5qcp No score
The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition ...
The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka "Web Proxy TCP State Limited Denial of Service Vulnerability."
- Record
GHSA-9rc2-2223-5qcp- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0077 is a medium vulnerability (CVSS 5.0) in Microsoft Forefront Threat Management Gateway, published April 15, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 78.5%, the 99th percentile. No source names a fixed version.
References
securitytracker.com/id?1022045
docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-016
osvdb.org/53636
us-cert.gov/cas/techalerts/TA09-104A.html
vupen.com/english/advisories/2009/1030
secunia.com/advisories/34687
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6068
nvd.nist.gov/vuln/detail/CVE-2009-0077
github.com/advisories/GHSA-9rc2-2223-5qcp