Executive Summary
| Summary | |
|---|---|
| Title | Vulnerabilities in Event System Could Allow Remote Code Execution (950974) |
| Informations | |||
|---|---|---|---|
| Name | MS08-049 | First vendor Publication | 2008-08-12 |
| Vendor | Microsoft | Last vendor Modification | 2008-09-10 |
| Severity (Vendor) | Important | Revision | 1.1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Revision Note: V1.1 (September 10, 2008): Corrected a registry key verification entry for Windows XP.Summary: This update resolves two privately reported vulnerabilities in Microsoft Windows Event System that could allow remote code execution. An attacker who successfully exploited these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights. |
Original Source
| Url : http://www.microsoft.com/technet/security/bulletin/MS08-049.mspx |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:5630 | |||
| Oval ID: | oval:org.mitre.oval:def:5630 | ||
| Title: | Event System Vulnerability | ||
| Description: | Array index vulnerability in the Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote authenticated users to execute arbitrary code via a crafted event subscription request that is used to access an array of function pointers. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2008-1456 | Version: | 4 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:6095 | |||
| Oval ID: | oval:org.mitre.oval:def:6095 | ||
| Title: | Event System Vulnerability | ||
| Description: | The Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate per-user subscriptions, which allows remote authenticated users to execute arbitrary code via a crafted event subscription request. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2008-1457 | Version: | 4 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 1 | |
| Os | 2 | |
| Os | 1 | |
| Os | 1 | |
| Os | 3 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-10-07 | Name : Microsoft Windows Image Color Management System Code Execution Vulnerability ... File : nvt/gb_ms08-046.nasl |
| 2008-08-19 | Name : Vulnerabilities in Event System Could Allow Remote Code Execution (950974) File : nvt/secpod_ms08-049_900035.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 47412 | Microsoft Windows Event System Crafted Request Array Index Handling Remote Pr... |
| 47411 | Microsoft Windows Event System Per-user Subscription Crafted Request Remote P... |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2008-08-14 | IAVM : 2008-T-0039 - Multiple Microsoft Event System Remote Code Execution Vulnerabilities Severity : Category I - VMSKEY : V0016744 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Windows Event System Subscription VBScript access RuleID : 13979 - Revision : 14 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows Event System ActiveX function call unicode access RuleID : 13978 - Revision : 9 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Microsoft Windows Event System ActiveX function call access RuleID : 13977 - Revision : 10 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Microsoft Windows Event System ActiveX clsid unicode access RuleID : 13976 - Revision : 9 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Microsoft Windows Event System ActiveX clsid access RuleID : 13975 - Revision : 10 - Type : BROWSER-PLUGINS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-08-13 | Name : Arbitrary code can be executed on the remote host through the Microsoft Event... File : smb_nt_ms08-049.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:46:02 |
|
| 2014-01-19 21:30:14 |
|
| 2013-11-11 12:41:09 |
|
| 2013-05-11 00:49:21 |
|
