PT-2008-1138 · Microsoft · Windows Server 2003+7

Debasis Mohanty + 1 · Published 2008-10-23 · Updated 2026-05-21 · CVE-2008-4250

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 SP4 Microsoft Windows XP SP2 and SP3 Microsoft Windows Server 2003 SP1 and SP2 Microsoft Windows Vista Gold and SP1 Microsoft Windows Server 2008 Microsoft Windows 7 Pre-Beta Windows Embedded Standard 2009

Description The issue is related to a remote code execution vulnerability in the Server service, which can be exploited by sending a specially crafted RPC request. This vulnerability was exploited in the wild by Gimmiv.A in October 2008. The problem lies in the improper handling of path canonicalization, leading to a buffer overflow. This can result in the execution of arbitrary code or denial of service. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For Microsoft Windows 2000 SP4, update to a newer version to mitigate the risk. For Microsoft Windows XP SP2 and SP3, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 SP1 and SP2, update to a newer version to mitigate the risk. For Microsoft Windows Vista Gold and SP1, update to a newer version to mitigate the risk. For Microsoft Windows Server 2008, update to a newer version to mitigate the risk. For Microsoft Windows 7 Pre-Beta, update to a newer version to mitigate the risk. For Windows Embedded Standard 2009, consider disabling the NetprPathCanonicalize function in the netapi32.dll module as a temporary workaround until a patch is available. Restrict access to the C:WindowsSystem32 directory to minimize the risk of exploitation. Avoid using the NetprPathCanonicalize function until the issue is resolved.

Exploit

Fix

RCE

Buffer Overflow

Code Injection

Weakness Enumeration

CWE-119

CWE-94

Related Identifiers

BDU:2015-10404

CONFICKERDETECTION

CVE-2008-4250

WINDOWSSERVICESERVERMS08067

Affected Products

Windows 2000

Windows 7

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

Windows

Windows Embedded Standard 2009

References · 36

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms08_067_netapi.rb · Exploit
• 🔥 https://github.com/pxcs/CVE-29343-Sysmon-list · Exploit
• 🔥 http://securityfocus.com/bid/31874 · Exploit
• 🔥 https://exploit-db.com/exploits/16362 · Exploit
• 🔥 https://exploit-db.com/exploits/6841 · Exploit
• 🔥 https://exploit-db.com/exploits/7132 · Exploit
• 🔥 https://exploit-db.com/exploits/7104 · Exploit
• 🔥 https://exploit-db.com/exploits/6824 · Exploit
• 🔥 https://exploit-db.com/exploits/40279 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4250 · Security Note
• http://vupen.com/english/advisories/2008/2902 · Vendor Advisory
• https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067 · Security Note
• https://bdu.fstec.ru/vul/2015-10404 · Security Note
• http://secunia.com/advisories/32326 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067 · Vendor Advisory