CVE-2008-3466
CVSS V2 High 10
CVSS V3 None
Description
Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS Command Execution Vulnerability."
Overview
- CVE ID
- CVE-2008-3466
- Assigner
- secure@microsoft.com
- Vulnerability Status
- Modified
- Published Version
- 2008-10-15T00:12:15
- Last Modified Date
- 2018-10-12T21:48:03
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:microsoft:host_integration_server_2000:*:*:*:*:client:*:*:* | 1 | OR | ||
| cpe:2.3:a:microsoft:host_integration_server_2000:*:sp2:*:*:server:*:*:* | 1 | OR | ||
| cpe:2.3:a:microsoft:host_integration_server_2004:*:*:*:*:client:*:*:* | 1 | OR | ||
| cpe:2.3:a:microsoft:host_integration_server_2004:*:*:*:*:server:*:*:* | 1 | OR | ||
| cpe:2.3:a:microsoft:host_integration_server_2004:*:sp1:*:*:server:*:*:* | 1 | OR | ||
| cpe:2.3:a:microsoft:host_integration_server_2006:*:*:*:*:*:*:x64:* | 1 | OR | ||
| cpe:2.3:a:microsoft:host_integration_server_2006:*:*:*:*:*:*:x86:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:C/I:C/A:C
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- COMPLETE
- Integrity Impact
- COMPLETE
- Availability Impact
- COMPLETE
- Base Score
- 10
- Severity
- HIGH
- Exploitability Score
- 10
- Impact Score
- 10
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2008-3466 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3466 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 18:24:59 | Added to TrackCVE |