Vulnerability record · CVE-2010-3229 · published 13 October 2010
CVE-2010-3229: Windows SChannel TLS client certificate handling denial of service
Microsoft · Windows 7
The SChannel security package on Windows Vista, Server 2008 and Windows 7 with IIS 7.x fails to properly process client certificates during SSL/TLS handshakes. A crafted packet can crash LSASS and force a reboot, taking the affected host offline.
Description
The Secure Channel (aka SChannel) security package in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when IIS 7.x is used, does not properly process client certificates during SSL and TLS handshakes, which allows remote attackers to cause a denial of service (LSASS outage and reboot) via a crafted packet, aka "TLSv1 Denial of Service Vulnerability."
AV:N/AC:M/Au:N/C:N/I:N/A:C
Automated analysis
high priorityUnauthenticated remote denial of service with complete availability impact and very high EPSS, though no confirmed in-the-wild exploitation is recorded.
What it is
The SChannel security package on Windows Vista, Server 2008 and Windows 7 with IIS 7.x fails to properly process client certificates during SSL/TLS handshakes. A crafted packet can crash LSASS and force a reboot, taking the affected host offline.
Impact
An unauthenticated remote attacker can cause a denial of service: LSASS outage followed by a system reboot, disrupting any service hosted on the machine.
Attack surface
Reachable over the network via the SSL/TLS listener on IIS 7.x; no authentication or user interaction is required, though the CVSS vector notes medium attack complexity.
Exploitation
Not listed in CISA KEV and no exploit tags in the references, but EPSS is high (0.502, ~98.9th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Apply Microsoft security bulletin MS10-085 (the vendor fix) to all affected Windows Vista, Server 2008 and Windows 7 systems running IIS 7.x.
- Where patching is delayed, restrict or disable client certificate authentication on IIS 7.x TLS endpoints and limit exposure of those listeners to trusted networks.
- Monitor and rate-limit inbound TLS handshake traffic to IIS hosts to reduce the chance of a crafted packet reaching SChannel.
- Retire or isolate end-of-life platforms (Vista, Server 2008, Windows 7) that no longer receive security updates.
Detection
- Alert on unexpected LSASS process termination or crash events on IIS 7.x hosts, especially correlated with a subsequent reboot.
- Monitor Windows system and application logs for SChannel/TLS handshake errors clustered around a host outage.
- Baseline and watch for abnormal spikes in inbound TLS connection attempts or malformed handshake patterns against IIS endpoints.
- Track reboot events on internet-facing IIS servers that are not explained by maintenance or patch activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-3229 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-3229), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
