PT-2008-3997 · Microsoft+1 · Windows Server 2008+7

Aviv Raff · Published 2008-06-03 · Updated 2019-02-26 · CVE-2008-2540

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 3.1.2 on Windows Apple Safari on Mac OS X (affected versions not specified) Internet Explorer 7 on Windows XP (affected versions not specified) Windows XP, Vista, and Server 2003 and 2008 (affected versions not specified)

Description The issue allows remote attackers to place malware into specific directories, which can lead to the execution of arbitrary code. This is possible due to an untrusted search path vulnerability in certain Windows components and Internet Explorer. An attacker could exploit this by convincing a user to download a specially crafted file to a specific location or by constructing a specially crafted web page. If successfully exploited, an attacker could gain the same user rights as the logged-on user, potentially taking complete control of an affected system.

Recommendations For Apple Safari on Windows, update to version 3.1.2 or later. For Apple Safari on Mac OS X, consider disabling the automatic download feature for unrecognized content types until a patch is available. For Internet Explorer 7 on Windows XP, restrict access to untrusted websites and avoid opening suspicious files. For Windows XP, Vista, and Server 2003 and 2008, consider implementing additional security measures to prevent the exploitation of the SearchPath function vulnerability, such as restricting file access permissions. At the moment, there is no information about a newer version that contains a fix for this vulnerability in Mac OS X.

Fix

RCE

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-2540

Affected Products

Internet Explorer

Macos X

Safari

Windows

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

References · 25

• http://microsoft.com/technet/security/advisory/953818.mspx · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-015 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-014 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2540 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2540 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42765 · Note
• http://securitytracker.com/id?1020150 · Note
• http://dhanjani.com/archives/2008/05/safari_carpet_bomb.html · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS09-015 · Note
• http://secunia.com/advisories/30467 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6108 · Note
• http://securityfocus.com/bid/29445 · Note
• http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx · Note
• http://vupen.com/english/advisories/2009/1029 · Note