CVE-2020-37215
Denial of Service via Oversized Input in MSN Password Recovery
Publication date: 2026-02-11
Last updated on: 2026-02-12
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| top_password | msn_password_recovery | 1.30 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "MSN Password Recovery version 1.30 contains a denial of service (DoS) vulnerability caused by a buffer overflow. This happens because the application does not properly check the size of the input in the 'User Name and Registration Code' field."}, {'type': 'paragraph', 'content': 'An attacker can supply an oversized input, specifically a 9000-byte buffer of repeated characters, which causes the application to crash when processing this input.'}, {'type': 'paragraph', 'content': 'This vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), indicating a classic buffer overflow issue.'}] [1, 2]
How can this vulnerability impact me? :
The primary impact of this vulnerability is a denial of service condition where the MSN Password Recovery application crashes and becomes unavailable.
An attacker with local access and the ability to interact with the user interface can trigger this crash by inputting a specially crafted oversized registration code.
This can disrupt normal use of the application, potentially preventing legitimate users from recovering passwords until the application is restarted or fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by attempting to reproduce the denial of service condition on the MSN Password Recovery version 1.30 application. Specifically, an oversized input of 9000 repeated characters can be supplied to the 'User Name and Registration Code' field to trigger the crash."}, {'type': 'list_item', 'content': "Generate a file containing 9000 repeated characters (e.g., 'A')."}, {'type': 'list_item', 'content': 'Copy the contents of this file to the clipboard.'}, {'type': 'list_item', 'content': "Launch MSN Password Recovery 1.30 and paste the contents into the 'User Name and Registration Code' input field."}, {'type': 'list_item', 'content': "Click 'OK' and observe if the application crashes, indicating the presence of the vulnerability."}] [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of MSN Password Recovery version 1.30 or restricting access to it, as the vulnerability requires local user interaction to trigger.
Since the vulnerability is triggered by oversized input in the registration code field, do not allow untrusted users to interact with the application or input data into this field.
Monitor and control local access to the system running MSN Password Recovery to prevent exploitation.
Check for any updates or patches from the vendor that address this buffer overflow vulnerability and apply them as soon as they become available.