PT-2008-3016 · Microsoft · Windows Server 2003+3

Published 2008-06-12 · Updated 2018-10-12 · CVE-2008-1445

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 Server version SP4 Microsoft Windows XP Professional versions SP2 through SP3 Microsoft Windows Server 2003 versions SP1 through SP2 Microsoft Windows Server 2008 (affected versions not specified)

Description The issue allows remote authenticated users to cause a denial of service, resulting in a system hang or reboot, by sending a crafted LDAP request.

Recommendations For Microsoft Windows 2000 Server SP4, apply the recommended configuration changes to prevent the denial of service. For Microsoft Windows XP Professional SP2 and SP3, restrict access to the LDAP service to minimize the risk of exploitation. For Microsoft Windows Server 2003 SP1 and SP2, consider disabling the LDAP service until a fix is available. For Microsoft Windows Server 2008, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-1445

Affected Products

Windows 2000 Server

Windows Server 2003

Windows Server 2008

Windows Xp Professional

References · 10

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-035 · Vendor Advisory
• http://secunia.com/advisories/30586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1445 · Security Note
• http://securityfocus.com/bid/29584 · Patch
• http://us-cert.gov/cas/techalerts/TA08-162B.html · Note
• http://securitytracker.com/id?1020229 · Note
• http://vupen.com/english/advisories/2008/1782 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4910 · Note
• http://securityfocus.com/archive/1/493338/100/0/threaded · Note
• http://securityfocus.com/archive/1/493342/100/0/threaded · Note