10

CVE-2008-3466

Exploit
Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS Command Execution Vulnerability."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Host Integration Server 2000 Updatesp2 SwEditionserver
Microsoft ≫ Host Integration Server 2004 Updatesp1 SwEditionserver
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 77.74% 0.995
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://marc.info/?l=bugtraq&m=122479227205998&w=2
http://www.us-cert.gov/cas/techalerts/TA08-288A.html
US Government Resource
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745
http://secunia.com/advisories/32233
Patch
Vendor Advisory
http://www.securityfocus.com/bid/31620
Patch
Exploit
http://www.securitytracker.com/id?1021043
http://www.vupen.com/english/advisories/2008/2810
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-059
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6075