PT-2008-6374 · Microsoft+1 · Windows 2000+3

Published 2008-11-26 · Updated 2019-12-03 · CVE-2008-5232

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Media Services versions prior to the fixed version

Description A buffer overflow issue exists in the CallHTMLHelp method of the Microsoft Windows Media Services ActiveX control, allowing remote attackers to execute arbitrary code via a long argument. This issue affects Windows Media Services on Microsoft Windows NT and 2000, as well as Avaya Media and Message Application servers.

Recommendations For Windows Media Services versions prior to the fixed version, update to the fixed version to resolve the issue. As a temporary workaround, consider restricting access to the CallHTMLHelp method in the nskey.dll until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2008-5232

Affected Products

Avaya Media/Message Application

Windows 2000

Windows Media Services

Windows Nt

References · 7

• 🔥 http://securityfocus.com/data/vulnerabilities/exploits/30814.html.txt · Exploit
• 🔥 https://exploit-db.com/exploits/32294 · Exploit
• 🔥 http://packetstormsecurity.org/0808-exploits/wms-overflow.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5232 · Security Note
• http://securityfocus.com/bid/30814 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44629 · Note
• http://securitytracker.com/id?1020733 · Note