Executive Summary

Summary
Title	Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-030 to MS08-036

Informations
Name	HPSBST02344 SSRT080087	First vendor Publication	2008-06-17
Vendor	HP	Last vendor Modification	2008-06-17
Severity (Vendor)	N/A	Revision	1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Various potential security vulnerabilities have been identified in Microsoft software that is running on the Storage Management Appliance (SMA). Some of these vulnerabilities may be pertinent to the SMA, please check the table in the Resolution section of this Security Bulletin.

Original Source

Url : http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01482941

CAPEC : Common Attack Pattern Enumeration & Classification

Id	Name
CAPEC-3	Using Leading 'Ghost' Character Sequences to Bypass Input Filters
CAPEC-7	Blind SQL Injection
CAPEC-8	Buffer Overflow in an API Call
CAPEC-9	Buffer Overflow in Local Command-Line Utilities
CAPEC-10	Buffer Overflow via Environment Variables
CAPEC-13	Subverting Environment Variable Values
CAPEC-14	Client-side Injection-induced Buffer Overflow
CAPEC-18	Embedding Scripts in Nonscript Elements
CAPEC-22	Exploiting Trust in Client (aka Make the Client Invisible)
CAPEC-24	Filter Failure through Buffer Overflow
CAPEC-28	Fuzzing
CAPEC-31	Accessing/Intercepting/Modifying HTTP Cookies
CAPEC-32	Embedding Scripts in HTTP Query Strings
CAPEC-42	MIME Conversion
CAPEC-43	Exploiting Multiple Input Interpretation Layers
CAPEC-45	Buffer Overflow via Symbolic Links
CAPEC-46	Overflow Variables and Tags
CAPEC-47	Buffer Overflow via Parameter Expansion
CAPEC-52	Embedding NULL Bytes
CAPEC-53	Postfix, Null Terminate, and Backslash
CAPEC-63	Simple Script Injection
CAPEC-64	Using Slashes and URL Encoding Combined to Bypass Validation Logic
CAPEC-66	SQL Injection
CAPEC-67	String Format Overflow in syslog()
CAPEC-71	Using Unicode Encoding to Bypass Validation Logic
CAPEC-72	URL Encoding
CAPEC-73	User-Controlled Filename
CAPEC-78	Using Escaped Slashes in Alternate Encoding
CAPEC-79	Using Slashes in Alternate Encoding
CAPEC-80	Using UTF-8 Encoding to Bypass Validation Logic
CAPEC-81	Web Logs Tampering
CAPEC-83	XPath Injection
CAPEC-85	Client Network Footprinting (using AJAX/XSS)
CAPEC-86	Embedding Script (XSS ) in HTTP Headers
CAPEC-88	OS Command Injection
CAPEC-91	XSS in IMG Tags
CAPEC-99	XML Parser Attack
CAPEC-101	Server Side Include (SSI) Injection
CAPEC-104	Cross Zone Scripting
CAPEC-106	Cross Site Scripting through Log Files
CAPEC-108	Command Line Execution through SQL Injection
CAPEC-109	Object Relational Mapping Injection
CAPEC-110	SQL Injection through SOAP Parameter Tampering
CAPEC-171	Variable Manipulation

CWE : Common Weakness Enumeration

%	Id	Name
56 %	CWE-20	Improper Input Validation
33 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer
11 %	CWE-94	Failure to Control Generation of Code ('Code Injection')

OVAL Definitions

 

Definition Id: oval:org.mitre.oval:def:4730
Oval ID:	oval:org.mitre.oval:def:4730
Title:	Bluetooth Vulnerability
Description:	The Bluetooth stack in Microsoft Windows XP SP2 and SP3, and Vista Gold and SP1, allows physically proximate attackers to execute arbitrary code via a large series of Service Discovery Protocol (SDP) packets.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-1453	Version:	5
Platform(s):	Microsoft Windows XP Microsoft Windows Vista	Product(s):
Definition Synopsis:
Windows XP Service Pack 2 Microsoft Windows XP (x86) SP2 is installed AND the version of Bthport.sys is less than 5.1.2600.3389 OR Windows XP Service Pack 3 Microsoft Windows XP (x86) SP3 is installed AND the version of Bthport.sys is less than 5.1.2600.5620 OR Check for Vulnerable Windows Vista(x86)/(x64) and Bthport.sys version Check for Vulnerable Windows Vista(x86)/(x64) Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Check for LDR/GDR the version of Bthport.sys is less than 6.0.6000.16682 OR Check for LDR Check if version of Bthport.sys is greater than or equal to 6.0.6000.20000 AND Check if version of Bthport.sys is less than 6.0.6000.20824 OR Check for Vulnerable Windows Vista SP1(x86)/(x64) and Bthport.sys version Check for Vulnerable Windows Vista SP1(x86)/(x64) Microsoft Windows Vista (32-bit) Service Pack 1 is installed AND Microsoft Windows Vista x64 Edition Service Pack 1 is installed AND Check for LDR/GDR the version of Bthport.sys is less than 6.0.6001.18064 OR Check for LDR Check if version of Bthport.sys is greater than or equal to 6.0.6001.22000 AND Check if version of Bthport.sys is less than 6.0.6001.22168 OR Check for Vulnerable Windows XP SP1(x64) and Bthport.sys version Microsoft Windows XP Professional x64 Edition SP1 is installed AND Check if version of Bthport.sys is less than 5.2.3790.3122 OR Check for Vulnerable Windows XP SP2(x64) and Bthport.sys version Microsoft Windows XP x64 Edition SP2 is installed AND Check if version of Bthport.sys is less than 5.2.3790.4274

 

Definition Id: oval:org.mitre.oval:def:4910
Oval ID:	oval:org.mitre.oval:def:4910
Title:	Windows Active Directory Denial of Service Vulnerability
Description:	Active Directory on Microsoft Windows 2000 Server SP4, XP Professional SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to cause a denial of service (system hang or reboot) via a crafted LDAP request.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-1445	Version:	10
Platform(s):	Microsoft Windows XP Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008	Product(s):
Definition Synopsis:
Vulnerable Windows 2000 SP4 Microsoft Windows 2000 SP4 or later is installed AND NTDS Service is installed AND ntdsa.dll version is less than 5.0.2195.7155 AND the system is being used as AD - DomainRole is 4 or 5 OR Vulnerable Windows Server 2003 SP1 (x86)/(x64) Windows Server 2003 SP1 (x86)/(x64) Microsoft Windows Server 2003 SP1 (x86) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Vulnerable Active directory or ADAM Vulnerable ADAM Check if ADAM service is installed AND adamdsa.dll version is less than 1.1.3790.3129 OR Vulnerable Active Directory NTDS Service is installed AND ntdsa.dll version is less than 5.2.3790.3122 AND the system is being used as AD - DomainRole is 4 or 5 OR Vulnerable Windows Server 2003 SP2 (x86)/(x64) Windows Server 2003 SP2 (x86)/(x64) Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Vulnerable Active Directory or ADAM Vulnerable ADAM Check if ADAM service is installed AND adamdsa.dll version is less than 1.1.3790.4281 OR Vulnerable Active Directory NTDS Service is installed AND ntdsa.dll version is less than 5.2.3790.4274 AND the system is being used as AD - DomainRole is 4 or 5 OR Vulnerable Windows XP SP2/SP3 Windows XP SP2/SP3 Microsoft Windows XP SP2 or later is installed AND Microsoft Windows XP (x86) SP3 is installed AND Check if ADAM service is installed AND adamdsa.dll version is less than 1.1.3790.4276 OR Vulnerable Windows XP x64 SP1 Microsoft Windows XP Professional x64 Edition SP1 is installed AND Check if ADAM service is installed AND adamdsa.dll version is less than 1.1.3790.3129 OR Vulnerable Windows XP x64 SP2 Microsoft Windows XP x64 Edition SP2 is installed AND Check if ADAM service is installed AND adamdsa.dll version is less than 1.1.3790.4281 OR Vulnerable Windows Server 2008 (32-bit)/(x64) Windows Server 2008 (32-bit)/(x64) Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Check for LDR/GDR ntdsai.dll version is less than 6.0.6001.18072 OR Check for LDR ntdsai.dll is greater than or equal 6.0.6001.22000 AND Check if version of ntdsai.dll is less than 6.0.6001.22179 AND the system is being used as AD - DomainRole is 4 or 5 OR Vulnerable Windows Server 2003 SP1 ia-64 Microsoft Windows Server 2003 SP1 for Itanium is installed AND NTDS Service is installed AND ntdsa.dll version is less than 5.2.3790.3122 AND the system is being used as AD - DomainRole is 4 or 5 OR Vulnerable Windows Server 2003 SP2 ia-64 Microsoft Windows Server 2003 (ia64) SP2 is installed AND NTDS Service is installed AND ntdsa.dll version is less than 5.2.3790.4274 AND the system is being used as AD - DomainRole is 4 or 5

 

Definition Id: oval:org.mitre.oval:def:5236
Oval ID:	oval:org.mitre.oval:def:5236
Title:	MJPEG Decoder Vulnerability
Description:	Microsoft DirectX 8.1 through 9.0c, and DirectX on Microsoft XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, does not properly perform MJPEG error checking, which allows remote attackers to execute arbitrary code via a crafted MJPEG stream in a (1) AVI or (2) ASF file, aka the "MJPEG Decoder Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-0011	Version:	11
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008	Product(s):	DirectX
Definition Synopsis:
DirectX 8.1/7.0 on Windows 2000 Microsoft Windows 2000 is installed AND the version of Quartz.dll is less than 6.3.1.891 AND DirectX 8.1 Installed OR DirectX 9.0 on Windows 2000 Microsoft Windows 2000 is installed AND DirectX 9.0x Installed AND the version of Quartz.dll is less than 6.5.1.909 OR DirectX 9.0 on Win XP Microsoft Windows XP is installed AND DirectX 9.0x Installed AND the version of Quartz.dll is less than 6.5.2600.3367 OR DirectX 9.0 on Win XP Microsoft Windows XP (32-bit) is installed AND DirectX 9.0x Installed AND the version of Quartz.dll is less than 6.5.2600.5596 OR DirectX 9.0 on 2003 and XP Check for Vulnerable Windows 2003 and Windows XP Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 (ia64) Gold is installed AND DirectX 9.0x Installed AND the version of Quartz.dll is less than 6.5.3790.3130 OR DirectX 9.0 on 2003 and XP Check for Vulnerable Windows 2003 and Windows XP Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 (ia64) Gold is installed AND Microsoft Windows XP x64 is installed AND DirectX 9.0x Installed AND the version of Quartz.dll is less than 6.5.3790.4283 OR Check for vulnerable Windows Vista(x86)/(x64) and Quartz.dll version Check for vulnerable Windows Vista(x86)/(x64) Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Check for LDR/GDR the version of Quartz.dll is less than 6.6.6000.16681 OR Check for LDR the version of Quartz.dll is greater than or equal 6.6.6000.20000 AND Check if version of Quartz.dll is less than 6.6.6000.20823 OR Check for Vulnerable Windows Vista(x86)/(x64)/Windows 2008(x86)/(x64)/(ia-64) and Quartz.dll version Check for Vulnerable Windows Vista(x86)/(x64)/Windows 2008(x86)/(x64)/(ia-64) Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (ia-64) is installed AND Check for LDR/GDR the version of Quartz.dll is less than 6.6.6001.18063 OR Check for LDR the version of Quartz.dll is greater than or equal 6.6.6001.22000 AND Check if version of Quartz.dll is less than 6.6.6001.22167

 

Definition Id: oval:org.mitre.oval:def:5291
Oval ID:	oval:org.mitre.oval:def:5291
Title:	Request Header Cross-Domain Information Disclosure Vulnerability
Description:	The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-1544	Version:	6
Platform(s):	Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Internet Explorer 5.01 Microsoft Internet Explorer 6 Microsoft Internet Explorer 7
Definition Synopsis:
Win 2K + IE5.01 Microsoft Windows 2000 is installed AND Microsoft Internet Explorer 5.01 SP4 is installed AND Mshtml.dll version is less than 5.0.3864.1800 OR Win 2K + IE6 Microsoft Windows 2000 is installed AND Microsoft Internet Explorer 6 is installed AND Mshtml.dll version is less than 6.0.2800.1611 OR Win XP X86 and IE 6 Mshtml.dll version is less than 6.0.2900.3354 AND Microsoft Windows XP (32-bit) is installed AND Microsoft Internet Explorer 6 is installed OR Win XP / Win 2K3 Microsoft Internet Explorer 7 is installed AND Win XP / Win 2K3 Microsoft Windows XP (32-bit) is installed AND Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 (ia64) Gold is installed AND Check for LDR / GDR Mshtml.dll version is less than 7.0.6000.16674 OR Check for GDR Mshtml.dll version is greater than 7.0.6000.20000 AND Check if the version of mshtml.dll is less than 7.0.6000.20815 OR Win XP X64 /Win 2K3 and IE6 Microsoft Internet Explorer 6 is installed AND Mshtml.dll version is less than 6.0.3790.3123 AND Win XP X64 /Win 2K3 Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 (ia64) Gold is installed OR Win XP X64/ Win 2K3 and IE 6 Microsoft Internet Explorer 6 is installed AND Mshtml.dll version is less than 6.0.3790.4275 AND Win XP X64 /Win 2K3 Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 (ia64) Gold is installed OR Win Vista and IE 7 Microsoft Windows Vista is installed AND Check for LDR / GDR Mshtml.dll version is less than 7.0.6000.16681 OR Check for LDR Mshtml.dll version is greater than 7.0.6000.20000 AND Check if the version of mshtml.dll is less than 7.0.6000.20823 AND Microsoft Internet Explorer 7 is installed OR Win Vista / Win 2K8 and IE 7 Microsoft Internet Explorer 7 is installed AND Win Vista / Win 2K8 Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Check for LDR / GDR Mshtml.dll version is less than 7.0.6001.18063 OR Check for LDR Mshtml.dll version is greater than or equal to 7.0.6001.22000 AND Check if the version of mshtml.dll is less than 7.0.6001.22167 OR Win XP X86 + IE6 Microsoft Windows XP (32-bit) is installed AND Check if the version of mshtml.dll is less than 6.0.2900.5583 AND Microsoft Internet Explorer 6 is installed

 

Definition Id: oval:org.mitre.oval:def:5473
Oval ID:	oval:org.mitre.oval:def:5473
Title:	PGM Invalid Length Vulnerability
Description:	Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted PGM packet, aka the "PGM Invalid Length Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-1440	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008	Product(s):
Definition Synopsis:
Vulnerable Windows XP SP2 Microsoft Windows XP SP2 or later is installed AND The version of Rmcast.sys is less than 5.1.2600.3369. OR Vulnerable Windows XP (x86) SP3 Microsoft Windows XP (x86) SP3 is installed AND The version of Rmcast.sys is less than 5.1.2600.5598. OR Vulnerable Windows XP SP1 (x64)/Server 2003 SP1 (x86)/(x64)/(ia-64) Windows XP SP1 (x64)/Server 2003 SP1 (x86)/(x64)/(ia-64) Microsoft Windows XP Professional x64 Edition SP1 is installed AND Microsoft Windows Server 2003 SP1 (x86) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 SP1 for Itanium is installed AND The version of Rmcast.sys is less than 5.2.3790.3136. OR Vulnerable Windows XP SP2 (x64)/Server 2003 SP2 (x86)/(x64)/(ia-64) Windows XP SP2 (x64)/Server 2003 SP2 (x86)/(x64)/(ia-64) Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND The version of Rmcast.sys is less than 5.2.3790.4290.

 

Definition Id: oval:org.mitre.oval:def:5489
Oval ID:	oval:org.mitre.oval:def:5489
Title:	Speech API Vulnerability
Description:	A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft Windows Vista, when the Speech Recognition feature is enabled, allows user-assisted remote attackers to delete arbitrary files, and conduct other unauthorized activities, via a web page with an embedded sound object that contains voice commands to an enabled microphone, allowing for interaction with Windows Explorer.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2007-0675	Version:	4
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008	Product(s):
Definition Synopsis:
IF Microsoft Windows 2000 SP4 or later is installed AND Microsoft Windows XP (x86) SP2 is installed AND Microsoft Windows XP (x86) SP3 is installed AND Microsoft Windows XP Professional x64 Edition SP1 is installed AND Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP1 (x86) is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 SP1 (x64) is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 (ia64) SP1 is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Server 2008 (ia-64) is installed AND  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{40F23EB7-B397-4285-8F3C-AACE4FA40309}!Compatibility Flags does not exist AND HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{40F23EB7-B397-4285-8F3C-AACE4FA40309}!Compatibility Flags is not equal to 0x00000400

 

Definition Id: oval:org.mitre.oval:def:5562
Oval ID:	oval:org.mitre.oval:def:5562
Title:	SAMI Format Parsing Vulnerability
Description:	Stack-based buffer overflow in Microsoft DirectX 7.0 and 8.1 on Windows 2000 SP4 allows remote attackers to execute arbitrary code via a Synchronized Accessible Media Interchange (SAMI) file with crafted parameters for a Class Name variable, aka the "SAMI Format Parsing Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-1444	Version:	3
Platform(s):	Microsoft Windows 2000	Product(s):	DirectX
Definition Synopsis:
DirectX 7 on Windows 2000 SP4 Microsoft Windows 2000 SP4 or later is installed AND DirectX 7.0x Installed AND the version of Quartz.dll is less than 6.1.9.734 OR DirectX 8.1 on Windows 2000 SP4 Microsoft Windows 2000 SP4 or later is installed AND DirectX 8.1 Installed AND the version of Quartz.dll is less than 6.3.1.891

 

Definition Id: oval:org.mitre.oval:def:5582
Oval ID:	oval:org.mitre.oval:def:5582
Title:	WINS Memory Overwrite Vulnerability
Description:	The WINS service on Microsoft Windows 2000 SP4, and Server 2003 SP1 and SP2, does not properly validate data structures in WINS network packets, which allows local users to gain privileges via a crafted packet, aka "Memory Overwrite Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-1451	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows Server 2003	Product(s):
Definition Synopsis:
Vulnerable Windows 2000 SP4 Microsoft Windows 2000 SP4 or later is installed AND the version of wins.exe is less than 5.0.2195.7155 OR Vulnerable Windows Server 2003 SP1 (x86)/(x64)/(ia-64) Windows Server 2003 SP1 (x86)/(x64)/(ia-64) Microsoft Windows Server 2003 SP1 (x86) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 SP1 for Itanium is installed AND the version of wins.exe is less than 5.2.3790.3119 OR Vulnerable Windows Server 2003 SP2 (x86)/(x64)/(ia-64) Windows Server 2003 SP2 (x86)/(x64)/(ia-64) Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 ia64 Service Pack 2 or later is installed AND the version of wins.exe is less than 5.2.3790.4271

 

Definition Id: oval:org.mitre.oval:def:5604
Oval ID:	oval:org.mitre.oval:def:5604
Title:	PGM Malformed Fragment Vulnerability
Description:	Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of service (system hang) via a series of Pragmatic General Multicast (PGM) packets with invalid fragment options, aka the "PGM Malformed Fragment Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-1441	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008	Product(s):
Definition Synopsis:
Vulnerable Windows XP SP2 Microsoft Windows XP SP2 or later is installed AND The version of Rmcast.sys is less than 5.1.2600.3369. OR Vulnerable Windows XP (x86) SP3 Microsoft Windows XP (x86) SP3 is installed AND The version of Rmcast.sys is less than 5.1.2600.5598. OR Vulnerable Windows XP SP1 (x64)/Server 2003 SP1 (x86)/(x64)/(ia-64) Windows XP SP1 (x64)/Server 2003 SP1 (x86)/(x64)/(ia-64) Microsoft Windows XP Professional x64 Edition SP1 is installed AND Microsoft Windows Server 2003 SP1 (x86) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 SP1 for Itanium is installed AND The version of Rmcast.sys is less than 5.2.3790.3136. OR Vulnerable Windows XP SP2 (x64)/Server 2003 SP2 (x86)/(x64)/(ia-64) Windows XP SP2 (x64)/Server 2003 SP2 (x86)/(x64)/(ia-64) Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND The version of Rmcast.sys is less than 5.2.3790.4290. OR Vulnerable Windows Vista (32-bit)/(x64) Windows Vista (32-bit)/(x64) Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Check for LDR/GDR The version of Rmcast.sys is less than 6.0.6000.16687. OR Check for LDR Check if version of Rmcast.sys is less that 6.0.6000.20832 AND Check if version of Rmcast.sys is greater than or equal to 6.0.6000.20000 OR Vulnerable Windows Vista SP1 (32-bit)/(x64)/Server 2008 (x86)/(x64)/(ia-64) Windows Vista SP1 (32-bit)/(x64)/Server 2008 (x86)/(x64)/(ia-64) Microsoft Windows Vista (32-bit) Service Pack 1 is installed AND Microsoft Windows Vista x64 Edition Service Pack 1 is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Check for LDR/GDR Check if version of Rmcast.sys is less than 6.0.6001.18069 OR Check for LDR Check if version of Rmcast.sys is greater than or equal to 6.0.6001.22000 AND Check if version of Rmcast.sys is less than 6.0.6001.22176

 

Definition Id: oval:org.mitre.oval:def:5720
Oval ID:	oval:org.mitre.oval:def:5720
Title:	HTML Objects Memory Corruption Vulnerability
Description:	Heap-based buffer overflow in the substringData method in Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code, related to an unspecified manipulation of a DOM object before a call to this method, aka the "HTML Objects Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-1442	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Internet Explorer 6 Microsoft Internet Explorer 7
Definition Synopsis:
Win 2K + IE6 Microsoft Windows 2000 is installed AND Microsoft Internet Explorer 6 is installed AND Mshtml.dll version is less than 6.0.2800.1611 OR Win XP X86 and IE 6 Mshtml.dll version is less than 6.0.2900.3354 AND Microsoft Windows XP (32-bit) is installed AND Microsoft Internet Explorer 6 is installed OR Win XP / Win 2K3 Microsoft Internet Explorer 7 is installed AND Win XP / Win 2K3 Microsoft Windows XP (32-bit) is installed AND Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 (ia64) Gold is installed AND Check for LDR / GDR Mshtml.dll version is less than 7.0.6000.16674 OR Check for GDR Mshtml.dll version is greater than 7.0.6000.20000 AND Check if the version of mshtml.dll is less than 7.0.6000.20815 OR Win XP X64 /Win 2K3 and IE6 Microsoft Internet Explorer 6 is installed AND Mshtml.dll version is less than 6.0.3790.3123 AND Win XP X64 /Win 2K3 Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 (ia64) Gold is installed OR Win XP X64/ Win 2K3 and IE 6 Microsoft Internet Explorer 6 is installed AND Mshtml.dll version is less than 6.0.3790.4275 AND Win XP X64 /Win 2K3 Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 (ia64) Gold is installed OR Win Vista and IE 7 Microsoft Windows Vista is installed AND Check for LDR / GDR Mshtml.dll version is less than 7.0.6000.16681 OR Check for LDR Mshtml.dll version is greater than 7.0.6000.20000 AND Check if the version of mshtml.dll is less than 7.0.6000.20823 AND Microsoft Internet Explorer 7 is installed OR Win Vista / Win 2K8 and IE 7 Microsoft Internet Explorer 7 is installed AND Win Vista / Win 2K8 Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Check for LDR / GDR Mshtml.dll version is less than 7.0.6001.18063 OR Check for LDR Mshtml.dll version is greater than or equal to 7.0.6001.22000 AND Check if the version of mshtml.dll is less than 7.0.6001.22167 OR Win XP X86 + IE6 Microsoft Windows XP (32-bit) is installed AND Check if the version of mshtml.dll is less than 6.0.2900.5583 AND Microsoft Internet Explorer 6 is installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Microsoft Directx cpe:2.3:a:microsoft:directx:10.0:*:*:*:*:*:*:* cpe:2.3:a:microsoft:directx:9.0:*:*:*:*:*:*:* cpe:2.3:a:microsoft:directx:8.1:*:*:*:*:*:*:* cpe:2.3:a:microsoft:directx:7.0:*:*:*:*:*:*:*	4
Application	Microsoft Internet Explorer cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*	4
Os	Microsoft Windows 2000 cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*	1
Os	Microsoft Windows 2003 Server cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:* cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:* cpe:2.3:o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:* cpe:2.3:o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_2003_server:*:sp1:itanium:*:*:*:*:* cpe:2.3:o:microsoft:windows_2003_server:-:sp2:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_2003_server:-:sp1:*:*:*:*:*:*	8
Os	Microsoft Windows Server 2003 cpe:2.3:o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:*:*:itanium:* cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:* cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*	7
Os	Microsoft Windows Server 2008 cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:itanium:* cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*	3
Os	Microsoft Windows Vista cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:* cpe:2.3:o:microsoft:windows_vista:*:*:32_bit:*:*:*:*:* cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:x64:*	6
Os	Microsoft Windows Xp cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:* cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_xp:*:*:x64:*:*:*:*:* cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_xp:-:*:*:*:professional:*:x64:* cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:* cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*	8
Os	Microsoft Windows-Nt cpe:2.3:o:microsoft:windows-nt:2008:*:x32:*:*:*:*:* cpe:2.3:o:microsoft:windows-nt:2008:*:x64:*:*:*:*:* cpe:2.3:o:microsoft:windows-nt:xp:sp3:pro:*:*:*:*:* cpe:2.3:o:microsoft:windows-nt:xp:sp3:*:*:*:*:*:*	4

OpenVAS Exploits

Date	Description
2011-01-18	Name : Microsoft Active Directory Denial of Service Vulnerability (953235) File : nvt/gb_ms08-035.nasl
2011-01-10	Name : Microsoft Windows Speech Components Voice Recognition Command Execution Vulne... File : nvt/gb_ms08-032.nasl
2011-01-10	Name : Microsoft Pragmatic General Multicast (PGM) Denial of Service Vulnerability ... File : nvt/gb_ms08-036.nasl
2008-09-30	Name : Bluetooth Stack Could Allow Remote Code Execution Vulnerability (951376) File : nvt/gb_ms08-030.nasl
2008-09-30	Name : Vulnerabilities in DirectX Could Allow Remote Code Execution (951698) File : nvt/gb_ms08-033.nasl
2008-09-29	Name : Cumulative Security Update for Internet Explorer (950759) File : nvt/gb_ms08-031.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
46084	Microsoft IE Request Header Handling Cross-domain Information Disclosure
46083	Microsoft IE HTML Object Handling Memory Corruption Arbitrary Code Execution A memory corruption flaw exists in Internet Explorer. IE fails to validate HTML objects resulting in memory corruption. With a specially crafted web page, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.
46068	Microsoft Windows Pragmatic General Multicast (PGM) Fragment Handling Remote DoS
46067	Microsoft Windows Pragmatic General Multicast (PGM) Packet Handling Remote DoS
46066	Microsoft Windows Active Directory LDAP Request Processing Remote DoS
46065	Microsoft DirectX SAMI File Format Processing Arbitrary Code Execution
46064	Microsoft DirectX MJPEG Codec AVI/ASF File Processing Arbitrary Code Execution
46063	Microsoft Windows Internet Name Service (WINS) Packet Handling Local Privileg...
46062	Microsoft Windows Speech Components (sapi.dll) Speech Recognition Code Execution
46061	Microsoft Windows Bluetooth SDP Packet Processing Remote Code Execution A code execution flaw exists in Windows. The Bluetooth stack fails to validate Service Delivery Protocol (SDP) packets resulting in potential code execution. With a large number of specially crafted SDP packets, an attacker can cause arbitrary code execution resulting in a loss of integrity.
43606	Microsoft IE XMLHttpRequest() Multiple Header Overwrite HTTP Response Splitting
33627	Microsoft Vista Speech Recognition Web Page Arbitrary Command Execution

Information Assurance Vulnerability Management (IAVM)

Date	Description
2008-06-26	IAVM : 2008-B-0049 - Microsoft Bluetooth Stack Remote Code Execution Vulnerability (951376) Severity : Category I - VMSKEY : V0016051
2008-06-12	IAVM : 2008-T-0025 - Microsoft Pragmatic General Multicast (PGM) Denial of Service Vulnerabilities Severity : Category I - VMSKEY : V0016038
2008-06-12	IAVM : 2008-A-0041 - Microsoft Active Directory Denial of Service Vulnerability Severity : Category I - VMSKEY : V0016040

Snort® IPS/IDS

Date	Description
2016-03-14	Microsoft Windows DirectX malformed mjpeg arbitrary code execution attempt RuleID : 37153 - Revision : 1 - Type : FILE-MULTIMEDIA
2016-03-14	Microsoft Windows DirectX malformed mjpeg arbitrary code execution attempt RuleID : 37152 - Revision : 1 - Type : FILE-MULTIMEDIA
2016-03-14	Microsoft Windows DirectX malformed mjpeg arbitrary code execution attempt RuleID : 37151 - Revision : 1 - Type : FILE-MULTIMEDIA
2016-03-14	Microsoft Internet Explorer sapi.dll ActiveX clsid access attempt RuleID : 36434 - Revision : 2 - Type : BROWSER-PLUGINS
2016-03-14	Microsoft Internet Explorer sapi.dll ActiveX clsid access attempt RuleID : 36433 - Revision : 2 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Windows Pragmatic General Multicast Protocol memory consumption den... RuleID : 17667 - Revision : 6 - Type : OS-WINDOWS
2014-01-10	Microsoft Internet Explorer setRequestHeader overflow attempt RuleID : 17385 - Revision : 8 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer setRequestHeader overflow attempt RuleID : 17384 - Revision : 7 - Type : BROWSER-IE
2014-01-10	Microsoft Windows DirectX malformed mjpeg arbitrary code execution attempt RuleID : 15995 - Revision : 16 - Type : FILE-MULTIMEDIA
2014-01-10	Microsoft Active Directory LDAP cookie denial of service attempt RuleID : 13835 - Revision : 12 - Type : OS-WINDOWS
2014-01-10	Microsoft Internet Explorer request header overwrite RuleID : 13834 - Revision : 18 - Type : BROWSER-IE
2014-01-10	backweb ActiveX clsid unicode access RuleID : 13833 - Revision : 7 - Type : WEB-ACTIVEX
2014-01-10	Microsoft Internet Explorer backweb ActiveX clsid access RuleID : 13832 - Revision : 11 - Type : BROWSER-PLUGINS
2014-01-10	sapi.dll alternate killbit ActiveX clsid unicode access RuleID : 13831 - Revision : 7 - Type : WEB-ACTIVEX
2014-01-10	Microsoft Internet Explorer sapi.dll ActiveX clsid access attempt RuleID : 13830 - Revision : 12 - Type : BROWSER-PLUGINS
2014-01-10	sapi.dll ActiveX clsid unicode access RuleID : 13829 - Revision : 7 - Type : WEB-ACTIVEX
2014-01-10	Microsoft Internet Explorer sapi.dll ActiveX clsid access attempt RuleID : 13828 - Revision : 12 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Windows PGM denial of service attempt RuleID : 13827 - Revision : 13 - Type : OS-WINDOWS
2014-01-10	Microsoft WINS arbitrary memory modification attempt RuleID : 13826 - Revision : 6 - Type : OS-WINDOWS
2014-01-10	Microsoft PGM fragment denial of service attempt RuleID : 13825 - Revision : 9 - Type : OS-WINDOWS
2014-01-10	Microsoft Windows DirectX malformed mjpeg arbitrary code execution attempt RuleID : 13824 - Revision : 15 - Type : FILE-MULTIMEDIA
2014-01-10	Microsoft Windows DirectX SAMI file parsing buffer overflow attempt RuleID : 13823 - Revision : 14 - Type : FILE-MULTIMEDIA
2014-01-10	Microsoft XML substringData integer overflow attempt RuleID : 12279 - Revision : 15 - Type : OS-WINDOWS

Nessus® Vulnerability Scanner

Date	Description
2008-06-12	Name : It is possible to crash Active Directory on the remote host. File : smb_nt_ms08-035.nasl - Type : ACT_GATHER_INFO
2008-06-11	Name : Arbitrary code can be executed on the remote host through Bluetooth. File : smb_nt_ms08-030.nasl - Type : ACT_GATHER_INFO
2008-06-10	Name : Arbitrary code can be executed on the remote host through the web client. File : smb_nt_ms08-031.nasl - Type : ACT_GATHER_INFO
2008-06-10	Name : The remote Windows host has an ActiveX control that is affected by multiple m... File : smb_nt_ms08-032.nasl - Type : ACT_GATHER_INFO
2008-06-10	Name : A vulnerability in DirectX could allow remote code execution. File : smb_nt_ms08-033.nasl - Type : ACT_GATHER_INFO
2008-06-10	Name : The remote WINS service can be abused to escalate privileges. File : smb_nt_ms08-034.nasl - Type : ACT_GATHER_INFO
2008-06-10	Name : An unauthenticated attacker can crash the remote host. File : smb_nt_ms08-036.nasl - Type : ACT_GATHER_INFO