PT-2008-3012 · Microsoft · Windows Xp+1

Published 2008-06-12 · Updated 2024-02-13 · CVE-2008-1440

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 versions SP1 through SP2

Description The issue arises from improper validation of the option length field in Pragmatic General Multicast (PGM) packets, allowing remote attackers to cause a denial of service. This can result in an infinite loop and system hang via a crafted PGM packet.

Recommendations For Microsoft Windows XP versions SP2 through SP3, apply the necessary patch to fix the improper validation of the option length field in PGM packets. For Microsoft Windows Server 2003 versions SP1 through SP2, apply the necessary patch to fix the improper validation of the option length field in PGM packets. As a temporary workaround, consider restricting access to PGM packets until a patch is available.

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2008-1440

Affected Products

Windows Server 2003

Windows Xp

References · 9

• http://secunia.com/advisories/30587 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1440 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-036 · Vendor Advisory
• http://securityfocus.com/bid/29508 · Patch
• http://us-cert.gov/cas/techalerts/TA08-162B.html · Note
• https://t.me/cvenotify/71250 · Telegram Post
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5473 · Note
• http://securitytracker.com/id?1020230 · Note
• http://vupen.com/english/advisories/2008/1783 · Note