Vulnerability Description
Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS Command Execution Vulnerability."
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Host Integration Server 2000 | All versions |
| Microsoft | Host Integration Server 2004 | All versions |
| Microsoft | Host Integration Server 2006 | All versions |
Related Weaknesses (CWE)
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745
- http://marc.info/?l=bugtraq&m=122479227205998&w=2
- http://secunia.com/advisories/32233PatchVendor Advisory
- http://www.securityfocus.com/bid/31620ExploitPatch
- http://www.securitytracker.com/id?1021043
- http://www.us-cert.gov/cas/techalerts/TA08-288A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2008/2810
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-05
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745
- http://marc.info/?l=bugtraq&m=122479227205998&w=2
- http://secunia.com/advisories/32233PatchVendor Advisory
- http://www.securityfocus.com/bid/31620ExploitPatch
- http://www.securitytracker.com/id?1021043
- http://www.us-cert.gov/cas/techalerts/TA08-288A.htmlUS Government Resource
FAQ
What is CVE-2008-3466?
CVE-2008-3466 is a vulnerability with a CVSS score of 10.0 (HIGH). Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary program...
How severe is CVE-2008-3466?
CVE-2008-3466 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-3466?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Host Integration Server 2000, Microsoft Host Integration Server 2004, Microsoft Host Integration Server 2006.