10
CVE-2008-4250
- EPSS 94.04%
- Published 23.10.2008 22:00:01
- Last modified 09.04.2025 00:30:58
- Source secure@microsoft.com
- Teams watchlist Login
- Open Login
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."
Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Windows 2000 Version- Updatesp4
Microsoft ≫ Windows Server 2003 Version- HwPlatformx64
Microsoft ≫ Windows Server 2003 Version- Updatesp1
Microsoft ≫ Windows Server 2003 Version- Updatesp1 SwEdition- HwPlatformitanium
Microsoft ≫ Windows Server 2003 Version- Updatesp2
Microsoft ≫ Windows Server 2003 Version- Updatesp2 HwPlatformitanium
Microsoft ≫ Windows Server 2003 Version- Updatesp2 HwPlatformx64
Microsoft ≫ Windows Server 2008 Version- SwEdition- HwPlatformitanium
Microsoft ≫ Windows Server 2008 Version- SwEdition- HwPlatformx64
Microsoft ≫ Windows Server 2008 Version- SwEdition- HwPlatformx86
Microsoft ≫ Windows Vista Version-
Microsoft ≫ Windows Vista Version- HwPlatformx64
Microsoft ≫ Windows Vista Version- Updatesp1
Microsoft ≫ Windows Vista Version- Updatesp1 SwEdition- HwPlatformx64
Microsoft ≫ Windows Xp Version- Update- SwEditionprofessional HwPlatformx64
Microsoft ≫ Windows Xp Version- Updatesp2
Microsoft ≫ Windows Xp Version- Updatesp2 SwEditionprofessional HwPlatformx64
Microsoft ≫ Windows Xp Version- Updatesp3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 94.04% | 0.999 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 10 | 10 | 10 |
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.