CVE-2008-4250

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 98,8%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada microsoft windows 2000, microsoft windows server 2003 +3 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP. Masuk katalog KEV CISA pada 20 Mei 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."

Rincian

Terbit di NVD

23 Oktober 2008

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

EPSS (30 hari)

98,8% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Microsoft Windows Buffer Overflow Vulnerability

Masuk KEV

20 Mei 2026

Tenggat CISA

3 Juni 2026 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://secunia.com/advisories/32326 patch · advisory vendor
• http://www.vupen.com/english/advisories/2008/2902 advisory vendor
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067 patch · advisory vendor
• http://www.securityfocus.com/bid/31874 broken link · exploit · patch · advisory pihak ketiga
• http://www.kb.cert.org/vuls/id/827267 advisory pihak ketiga · pemerintah AS
• http://www.us-cert.gov/cas/techalerts/TA08-297A.html broken link · advisory pihak ketiga · pemerintah AS
• http://www.us-cert.gov/cas/techalerts/TA09-088A.html advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4250 pemerintah AS
• http://marc.info/?l=bugtraq&m=122703006921213&w=2 issue tracking · mailing list · advisory pihak ketiga
• http://www.securityfocus.com/archive/1/497808/100/0/threaded broken link · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/archive/1/497816/100/0/threaded broken link · advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id?1021091 broken link · advisory pihak ketiga · vdb entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46040 advisory pihak ketiga · vdb entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6093 broken link · advisory pihak ketiga
• https://www.exploit-db.com/exploits/6824 exploit · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/6841 exploit · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/7104 exploit · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/7132 exploit · advisory pihak ketiga · vdb entry
• http://blogs.securiteam.com/index.php/archives/1150 permissions required