CVE-2008-1451
7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
6.2 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
0.4%
The WINS service on Microsoft Windows 2000 SP4, and Server 2003 SP1 and SP2, does not properly validate data structures in WINS network packets, which allows local users to gain privileges via a crafted packet, aka “Memory Overwrite Vulnerability.”
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| microsoft:windows_2000 | microsoft windows 2000 | eq | - |
| microsoft:windows_2003_server | microsoft windows 2003 server | eq | - |
References
secunia.com/advisories/30584
securitytracker.com/id?1020228
www.securityfocus.com/bid/29588
www.us-cert.gov/cas/techalerts/TA08-162B.html
www.vupen.com/english/advisories/2008/1781
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-034
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5582
Related
7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
6.2 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
0.4%