PT-2008-3020 · Microsoft · Windows Xp+2

Sowhat + 1 · Published 2008-06-11 · Updated 2018-10-12 · CVE-2008-1453

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Vista versions Gold through SP1

Description A remote code execution issue exists in the Bluetooth stack due to incorrect handling of a large number of service description requests. This could allow an attacker to run code with elevated privileges, potentially taking complete control of an affected system. The attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows XP versions SP2 through SP3, update to a version that correctly handles service description requests to prevent exploitation. For Microsoft Windows Vista versions Gold through SP1, update to a version that correctly handles service description requests to prevent exploitation. As a temporary workaround, consider disabling Bluetooth functionality until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-1453

Affected Products

Windows Vista

Windows Xp

Windows

References · 10

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-030 · Vendor Advisory
• http://securitytracker.com/id?1020221 · Patch
• http://secunia.com/advisories/30051 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1453 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-1453 · Security Note
• http://securityfocus.com/bid/29522 · Patch
• http://us-cert.gov/cas/techalerts/TA08-162B.html · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-030 · Note
• http://vupen.com/english/advisories/2008/1777 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4730 · Note