← back
CVE-2008-3466

CVE-2008-3466

40Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 78%
from disclosure to weapon0 days
Published on NVDOct 15
metasploitOct 14
exploitation probability
78%top 1% of all CVEs
observed exploitation
nono source reports it
Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS Command Execution Vulnerability."
Affected products
n/a · n/a
References
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745http://marc.info/?l=bugtraq&m=122479227205998&w=2https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-059http://secunia.com/advisories/32233https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6075http://www.securityfocus.com/bid/31620http://www.securitytracker.com/id?1021043http://www.us-cert.gov/cas/techalerts/TA08-288A.htmlhttp://www.vupen.com/english/advisories/2008/2810