All the vulnerabilites related to Microsoft - Windows Defender
cve-2019-1161
Vulnerability from cvelistv5
Published
2019-08-14 20:55
Modified
2024-08-04 18:06
Severity ?
EPSS score ?
Summary
Microsoft Defender Elevation of Privilege Vulnerability
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1161 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T18:06:31.818Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1161"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [],
"platforms": [
"Unknown"
],
"product": "Microsoft Forefront Endpoint Protection 2010",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [],
"platforms": [
"Unknown"
],
"product": "Microsoft System Center Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [],
"platforms": [
"Unknown"
],
"product": "Microsoft System Center 2012 R2 Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [],
"platforms": [
"Unknown"
],
"product": "Microsoft Security Essentials",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [],
"platforms": [
"Unknown"
],
"product": "Microsoft System Center 2012 Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [],
"platforms": [
"Windows 10 Version 1703 for 32-bit Systems",
"Windows 10 Version 1703 for x64-based Systems",
"Windows 10 Version 1709 for 32-bit Systems",
"Windows 10 Version 1709 for x64-based Systems",
"Windows 10 for 32-bit Systems",
"Windows 10 for x64-based Systems",
"Windows 10 Version 1607 for 32-bit Systems",
"Windows 10 Version 1607 for x64-based Systems",
"Windows Server 2016",
"Windows Server 2016 (Server Core installation)",
"Windows 7 for 32-bit Systems Service Pack 1",
"Windows 7 for x64-based Systems Service Pack 1",
"Windows 8.1 for 32-bit systems",
"Windows 8.1 for x64-based systems",
"Windows RT 8.1",
"Windows Server 2008 for 32-bit Systems Service Pack 2",
"Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)",
"Windows Server 2008 for Itanium-Based Systems Service Pack 2",
"Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1",
"Windows Server 2008 R2 for x64-based Systems Service Pack 1",
"Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
"Windows Server 2012",
"Windows Server 2012 (Server Core installation)",
"Windows Server 2012 R2",
"Windows Server 2012 R2 (Server Core installation)"
],
"product": "Windows Defender",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
}
],
"datePublic": "2019-08-13T07:00:00+00:00",
"descriptions": [
{
"lang": "en-US",
"value": "An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.\nTo exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted command that could exploit the vulnerability and delete protected files on an affected system once MpSigStub.exe ran again.\nThe update addresses the vulnerability and blocks the arbitrary deletion.\n"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-29T16:50:53.510Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1161"
}
],
"title": "Microsoft Defender Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2019-1161",
"datePublished": "2019-08-14T20:55:03",
"dateReserved": "2018-11-26T00:00:00",
"dateUpdated": "2024-08-04T18:06:31.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1647
Vulnerability from cvelistv5
Published
2021-01-12 19:42
Modified
2024-10-08 16:17
Severity ?
EPSS score ?
Summary
Microsoft Defender Remote Code Execution Vulnerability
References
| ▼ | URL | Tags |
|---|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1647 | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:18:11.008Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1647"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_endpoint_protection:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft System Center Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_endpoint_protection:2012:r2:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft System Center 2012 R2 Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:security_essentials:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Security Essentials",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_endpoint_protection:2012:-:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft System Center 2012 Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:*"
],
"platforms": [
"Windows 10 Version 1803 for 32-bit Systems",
"Windows 10 Version 1803 for x64-based Systems",
"Windows 10 Version 1803 for ARM64-based Systems",
"Windows 10 Version 1809 for 32-bit Systems",
"Windows 10 Version 1809 for x64-based Systems",
"Windows 10 Version 1809 for ARM64-based Systems",
"Windows Server 2019",
"Windows Server 2019 (Server Core installation)",
"Windows 10 Version 1909 for 32-bit Systems",
"Windows 10 Version 1909 for x64-based Systems",
"Windows 10 Version 1909 for ARM64-based Systems",
"Windows Server, version 1909 (Server Core installation)",
"Windows 10 Version 2004 for 32-bit Systems",
"Windows 10 Version 2004 for ARM64-based Systems",
"Windows 10 Version 2004 for x64-based Systems",
"Windows Server, version 2004 (Server Core installation)",
"Windows 10 Version 20H2 for 32-bit Systems",
"Windows 10 Version 20H2 for ARM64-based Systems",
"Windows Server, version 20H2 (Server Core Installation)",
"Windows 10 for 32-bit Systems",
"Windows 10 for x64-based Systems",
"Windows 10 Version 1607 for 32-bit Systems",
"Windows 10 Version 1607 for x64-based Systems",
"Windows Server 2016",
"Windows Server 2016 (Server Core installation)",
"Windows 7 for 32-bit Systems Service Pack 1",
"Windows 7 for x64-based Systems Service Pack 1",
"Windows 8.1 for 32-bit systems",
"Windows 8.1 for x64-based systems",
"Windows RT 8.1",
"Windows Server 2008 for 32-bit Systems Service Pack 2",
"Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)",
"Windows Server 2008 R2 for x64-based Systems Service Pack 1",
"Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
"Windows Server 2012",
"Windows Server 2012 (Server Core installation)",
"Windows Server 2012 R2",
"Windows Server 2012 R2 (Server Core installation)"
],
"product": "Windows Defender",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
}
],
"datePublic": "2021-01-12T08:00:00+00:00",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Defender Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-08T16:17:02.566Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Defender Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1647"
}
],
"title": "Microsoft Defender Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-1647",
"datePublished": "2021-01-12T19:42:01",
"dateReserved": "2020-12-02T00:00:00",
"dateUpdated": "2024-10-08T16:17:02.566Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-24092
Vulnerability from cvelistv5
Published
2021-02-25 23:01
Modified
2024-08-03 19:21
Severity ?
EPSS score ?
Summary
Microsoft Defender Elevation of Privilege Vulnerability
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24092 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:21:17.762Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24092"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [],
"platforms": [
"Unknown"
],
"product": "Microsoft Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [],
"platforms": [
"Unknown"
],
"product": "Microsoft System Center Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [],
"platforms": [
"Unknown"
],
"product": "Microsoft System Center 2012 R2 Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [],
"platforms": [
"Unknown"
],
"product": "Microsoft Security Essentials",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [],
"platforms": [
"Unknown"
],
"product": "Microsoft System Center 2012 Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"cpes": [],
"platforms": [
"Windows 10 Version 1803 for 32-bit Systems",
"Windows 10 Version 1803 for x64-based Systems",
"Windows 10 Version 1803 for ARM64-based Systems",
"Windows 10 Version 1809 for 32-bit Systems",
"Windows 10 Version 1809 for x64-based Systems",
"Windows 10 Version 1809 for ARM64-based Systems",
"Windows Server 2019",
"Windows Server 2019 (Server Core installation)",
"Windows 10 Version 1909 for 32-bit Systems",
"Windows 10 Version 1909 for x64-based Systems",
"Windows 10 Version 1909 for ARM64-based Systems",
"Windows Server, version 1909 (Server Core installation)",
"Windows 10 Version 1903 for 32-bit Systems",
"Windows 10 Version 1903 for x64-based Systems",
"Windows 10 Version 1903 for ARM64-based Systems",
"Windows Server, version 1903 (Server Core installation)",
"Windows 10 Version 2004 for 32-bit Systems",
"Windows 10 Version 2004 for ARM64-based Systems",
"Windows 10 Version 2004 for x64-based Systems",
"Windows Server, version 2004 (Server Core installation)",
"Windows 10 Version 20H2 for 32-bit Systems",
"Windows 10 Version 20H2 for ARM64-based Systems",
"Windows Server, version 20H2 (Server Core Installation)",
"Windows 10 for 32-bit Systems",
"Windows 10 for x64-based Systems",
"Windows 10 Version 1607 for 32-bit Systems",
"Windows 10 Version 1607 for x64-based Systems",
"Windows Server 2016",
"Windows Server 2016 (Server Core installation)",
"Windows 7 for 32-bit Systems Service Pack 1",
"Windows 7 for x64-based Systems Service Pack 1",
"Windows 8.1 for 32-bit systems",
"Windows 8.1 for x64-based systems",
"Windows Server 2008 for 32-bit Systems Service Pack 2",
"Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)",
"Windows Server 2008 R2 for x64-based Systems Service Pack 1",
"Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
"Windows Server 2012",
"Windows Server 2012 (Server Core installation)",
"Windows Server 2012 R2",
"Windows Server 2012 R2 (Server Core installation)"
],
"product": "Windows Defender",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
}
],
"datePublic": "2021-02-09T08:00:00+00:00",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Defender Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-29T22:33:40.503Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24092"
}
],
"title": "Microsoft Defender Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-24092",
"datePublished": "2021-02-25T23:01:48",
"dateReserved": "2021-01-13T00:00:00",
"dateUpdated": "2024-08-03T19:21:17.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-0986
Vulnerability from cvelistv5
Published
2018-04-04 17:00
Modified
2024-08-05 03:44
Severity ?
EPSS score ?
Summary
A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability." This affects Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, Microsoft Exchange Server, Microsoft System Center, Microsoft Forefront Endpoint Protection.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id/1040631 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/103593 | vdb-entry, x_refsource_BID | |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0986 | x_refsource_CONFIRM | |
| https://www.exploit-db.com/exploits/44402/ | exploit, x_refsource_EXPLOIT-DB |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:44:11.806Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1040631",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1040631"
},
{
"name": "103593",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/103593"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0986"
},
{
"name": "44402",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44402/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Windows Defender",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "Windows 10 for 32-bit Systems"
},
{
"status": "affected",
"version": "Windows 10 for x64-based Systems"
},
{
"status": "affected",
"version": "Windows 10 Version 1511 for 32-bit Systems"
},
{
"status": "affected",
"version": "Windows 10 Version 1511 for x64-based Systems"
},
{
"status": "affected",
"version": "Windows 10 Version 1607 for 32-bit Systems"
},
{
"status": "affected",
"version": "Windows 10 Version 1607 for x64-based Systems"
},
{
"status": "affected",
"version": "Windows 10 Version 1703 for 32-bit Systems"
},
{
"status": "affected",
"version": "Windows 10 Version 1703 for x64-based Systems"
},
{
"status": "affected",
"version": "Windows 10 Version 1709 for 32-bit Systems"
},
{
"status": "affected",
"version": "Windows 10 Version 1709 for x64-based Systems"
},
{
"status": "affected",
"version": "Windows 7 for 32-bit Systems Service Pack 1"
},
{
"status": "affected",
"version": "Windows 7 for x64-based Systems Service Pack 1"
},
{
"status": "affected",
"version": "Windows 8.1 for 32-bit systems"
},
{
"status": "affected",
"version": "Windows 8.1 for x64-based systems"
},
{
"status": "affected",
"version": "Windows RT 8.1"
},
{
"status": "affected",
"version": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1"
},
{
"status": "affected",
"version": "Windows Server 2008 R2 for x64-based Systems Service Pack 1"
},
{
"status": "affected",
"version": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)"
},
{
"status": "affected",
"version": "Windows Server 2012"
},
{
"status": "affected",
"version": "Windows Server 2012 (Server Core installation)"
},
{
"status": "affected",
"version": "Windows Server 2012 R2"
},
{
"status": "affected",
"version": "Windows Server 2012 R2 (Server Core installation)"
},
{
"status": "affected",
"version": "Windows Server 2016"
},
{
"status": "affected",
"version": "Windows Server 2016 (Server Core installation)"
},
{
"status": "affected",
"version": "Windows Server, version 1709 (Server Core Installation)"
}
]
},
{
"product": "Windows Intune Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "Windows Intune Endpoint Protection"
}
]
},
{
"product": "Microsoft Security Essentials",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "Microsoft Security Essentials"
}
]
},
{
"product": "Microsoft System Center Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "Microsoft System Center Endpoint Protection"
}
]
},
{
"product": "Microsoft Exchange Server",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "2013"
},
{
"status": "affected",
"version": "2016"
}
]
},
{
"product": "Microsoft System Center",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "2012 Endpoint Protection"
},
{
"status": "affected",
"version": "2012 R2 Endpoint Protection"
}
]
},
{
"product": "Microsoft Forefront Endpoint Protection",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "2010"
}
]
}
],
"datePublic": "2018-04-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka \"Microsoft Malware Protection Engine Remote Code Execution Vulnerability.\" This affects Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, Microsoft Exchange Server, Microsoft System Center, Microsoft Forefront Endpoint Protection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-12T00:57:01",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "1040631",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1040631"
},
{
"name": "103593",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/103593"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0986"
},
{
"name": "44402",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44402/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2018-0986",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Windows Defender",
"version": {
"version_data": [
{
"version_value": "Windows 10 for 32-bit Systems"
},
{
"version_value": "Windows 10 for x64-based Systems"
},
{
"version_value": "Windows 10 Version 1511 for 32-bit Systems"
},
{
"version_value": "Windows 10 Version 1511 for x64-based Systems"
},
{
"version_value": "Windows 10 Version 1607 for 32-bit Systems"
},
{
"version_value": "Windows 10 Version 1607 for x64-based Systems"
},
{
"version_value": "Windows 10 Version 1703 for 32-bit Systems"
},
{
"version_value": "Windows 10 Version 1703 for x64-based Systems"
},
{
"version_value": "Windows 10 Version 1709 for 32-bit Systems"
},
{
"version_value": "Windows 10 Version 1709 for x64-based Systems"
},
{
"version_value": "Windows 7 for 32-bit Systems Service Pack 1"
},
{
"version_value": "Windows 7 for x64-based Systems Service Pack 1"
},
{
"version_value": "Windows 8.1 for 32-bit systems"
},
{
"version_value": "Windows 8.1 for x64-based systems"
},
{
"version_value": "Windows RT 8.1"
},
{
"version_value": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1"
},
{
"version_value": "Windows Server 2008 R2 for x64-based Systems Service Pack 1"
},
{
"version_value": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)"
},
{
"version_value": "Windows Server 2012"
},
{
"version_value": "Windows Server 2012 (Server Core installation)"
},
{
"version_value": "Windows Server 2012 R2"
},
{
"version_value": "Windows Server 2012 R2 (Server Core installation)"
},
{
"version_value": "Windows Server 2016"
},
{
"version_value": "Windows Server 2016 (Server Core installation)"
},
{
"version_value": "Windows Server, version 1709 (Server Core Installation)"
}
]
}
},
{
"product_name": "Windows Intune Endpoint Protection",
"version": {
"version_data": [
{
"version_value": "Windows Intune Endpoint Protection"
}
]
}
},
{
"product_name": "Microsoft Security Essentials",
"version": {
"version_data": [
{
"version_value": "Microsoft Security Essentials"
}
]
}
},
{
"product_name": "Microsoft System Center Endpoint Protection",
"version": {
"version_data": [
{
"version_value": "Microsoft System Center Endpoint Protection"
}
]
}
},
{
"product_name": "Microsoft Exchange Server",
"version": {
"version_data": [
{
"version_value": "2013"
},
{
"version_value": "2016"
}
]
}
},
{
"product_name": "Microsoft System Center",
"version": {
"version_data": [
{
"version_value": "2012 Endpoint Protection"
},
{
"version_value": "2012 R2 Endpoint Protection"
}
]
}
},
{
"product_name": "Microsoft Forefront Endpoint Protection",
"version": {
"version_data": [
{
"version_value": "2010"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka \"Microsoft Malware Protection Engine Remote Code Execution Vulnerability.\" This affects Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, Microsoft Exchange Server, Microsoft System Center, Microsoft Forefront Endpoint Protection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1040631",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1040631"
},
{
"name": "103593",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/103593"
},
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0986",
"refsource": "CONFIRM",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0986"
},
{
"name": "44402",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44402/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2018-0986",
"datePublished": "2018-04-04T17:00:00",
"dateReserved": "2017-12-01T00:00:00",
"dateUpdated": "2024-08-05T03:44:11.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
var-200805-0217
Vulnerability from variot
Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (engine hang and restart) via a crafted file, a different vulnerability than CVE-2008-1438. Attackers can exploit this issue to cause an affected computer to stop responding or to restart. Successful attacks will deny service to legitimate users. ----------------------------------------------------------------------
Secunia Network Software Inspector 2.0 (NSI) - Public Beta
The Public Beta has ended. Thanks to all that participated.
PROVIDED AND/OR DISCOVERED BY: The vendor credits SoWhat, Nevis Labs.
ORIGINAL ADVISORY: MS08-029 (KB952044): http://www.microsoft.com/technet/security/Bulletin/MS08-029.mspx
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. Microsoft Malware Protection Engine TWO DoS Vulnerabilities
By Sowhat of Nevis Labs Date: 2008.05.14
http://www.nevisnetworks.com http://secway.org/advisory/AD20080514.txt
CVE: CVE-2008-1437 CVE-2008-1438
Vendor Microsoft
Affected: Windows Live OneCare Microsoft Antigen for Exchange Microsoft Antigen for SMTP Gateway Microsoft Windows Defender Microsoft Forefront Client Security Microsoft Forefront Security for Exchange Server Microsoft Forefront Security for SharePoint Standalone System Sweeper located in Diagnostics and Recovery Toolset 6.0
Details:
There are two vulnerabilities idenitified in Microsoft Antivirus product. These vulnerabilities can be exploited to cause Denial of service.
- CVE-2008-1437 PE Parsing Memory Corruption While scanning a specially crafted PE file, Malware orotection engine (MsMpEng.exe/mpengine.dll for Windows Live OneCare) will crash.
Currently, There's no evidence of code execution found.
Please note that this vulnerability can be triggered in various ways: a. by sending emails to target mail server which is protected by MS antivirus b. by sending emails to victim who is using Windows Onecare or Windows Defender. c. by convining the victim to visit some websites. d. by sending files (can be any extension) to victims through P2P/IM.
Real Time protection is enabled by default, so in the case b&c, the vulnerability can be exploited without any further user interaction after the victim recieved the email or opened the website.
- CVE-2008-1438 PE Parsing Disk Space D.o.S While parsing a specially crafted file with a malformed "size of header" is scanned by Microsoft Windows OneCare, there will be Disk Space DOS condition.
Microsoft Malware protection engine will allocate disk space as much as the PE file "claimed", It can "eat" several Gb disk space of Windows installation driver.
Proof of Concept: No POC will be released.
Fix: Microsoft has released an update address this issue. http://www.microsoft.com/technet/security/Bulletin/MS08-029.mspx
Vendor Response:
2008.04.18 Vendor notified via email 2008.04.18 Vendor response, developing for patch 2008.05.14 Patch Release 2008.05.14 Advisory released
-- Sowhat http://secway.org "Life is like a bug, Do you know how to exploit it ?" . The most severe vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code.
II. Impact
A remote, unauthenticated attacker could execute arbitrary code, gain elevated privileges, or cause a denial of service.
III. Solution
Apply updates from Microsoft
Microsoft has provided updates for these vulnerabilities in the May 2008 Security Bulletin Summary. The security bulletin describes any known issues related to the updates. Administrators are encouraged to note these issues and test for any potentially adverse effects. Administrators should consider using an automated update distribution system such as Windows Server Update Services (WSUS).
IV. References
* US-CERT Vulnerability Notes for Microsoft May 2008 updates -
<http://www.kb.cert.org/vuls/byid?searchview&query=ms08-may>
* Microsoft Security Bulletin Summary for May 2008 -
<http://www.microsoft.com/technet/security/bulletin/ms08-may.mspx>
* Microsoft Update -
<https://www.update.microsoft.com/microsoftupdate/>
* Windows Server Update Services -
<http://www.microsoft.com/windowsserversystem/updateservices/default.mspx>
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/techalerts/TA08-134A.html>
Feedback can be directed to US-CERT Technical Staff. Please send email to cert@cert.org with "TA08-134A Feedback VU#534907" in the subject.
For instructions on subscribing to or unsubscribing from this mailing list, visit http://www.us-cert.gov/cas/signup.html.
Produced 2008 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
Revision History
May 13, 2008: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBSCnrE/RFkHkM87XOAQJAoAf/XrkJlT9AS30/CZwAMO9qta8TbtLQTZR3 /yAV/h2CmOKhFsbjdh8L4+GcP0n66twWhmMBfBs6BosOoaqqhkeJcE6JoyQ2Kso1 MnhXjPJuGtgEPcfYX9bg42rnZ5WDXGh9EuhoZVyUV4UeUQ8qRM8LL3OIWBHubE7R fcOqIVDz/qtCC1U+RUdrbdeV8XB48mshiLoWjxzOT0FzeOKsBwsyHzaO5mAeEy4E 1hsLC2u4idGlq9Ezl82XODyH6vtHBKq7yKDv+FkVHbCqwB+thqPkUo2es+amASra shcJggg39WWmPWphqnBz94rkdwitsvW3ymOWt1F27GecX1sveofLDQ== =rhf4 -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200805-0217",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "malware protection engine",
"scope": "eq",
"trust": 1.6,
"vendor": "microsoft",
"version": "0.1.13.192"
},
{
"model": "diagnostics and recovery toolkit",
"scope": "eq",
"trust": 1.6,
"vendor": "microsoft",
"version": "6.0"
},
{
"model": "malware protection engine",
"scope": "eq",
"trust": 1.6,
"vendor": "microsoft",
"version": "1.1.3520.0"
},
{
"model": "forefront client security",
"scope": null,
"trust": 1.4,
"vendor": "microsoft",
"version": null
},
{
"model": "windows defender",
"scope": null,
"trust": 1.4,
"vendor": "microsoft",
"version": null
},
{
"model": "windows live onecare",
"scope": null,
"trust": 1.4,
"vendor": "microsoft",
"version": null
},
{
"model": "forefront client security",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "forefront security for exchange server",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "forefront security for sharepoint",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "windows defender",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "windows live onecare",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "antigen for smtp gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "antigen for exchange",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "diagnostics and recovery toolset",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "6.0"
},
{
"model": "antigen",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "for exchange"
},
{
"model": "antigen",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "for smtp gateway"
},
{
"model": "forefront security",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "for exchange server"
},
{
"model": "forefront security",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "for sharepoint"
},
{
"model": "forefront security for exchange server",
"scope": null,
"trust": 0.6,
"vendor": "microsoft",
"version": null
},
{
"model": "antigen for exchange",
"scope": null,
"trust": 0.6,
"vendor": "microsoft",
"version": null
},
{
"model": "forefront security for sharepoint",
"scope": null,
"trust": 0.6,
"vendor": "microsoft",
"version": null
},
{
"model": "antigen for smtp gateway",
"scope": null,
"trust": 0.6,
"vendor": "microsoft",
"version": null
},
{
"model": "windows live onecare",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "0"
},
{
"model": "windows defender edition",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "x640"
},
{
"model": "windows defender",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "0"
},
{
"model": "standalone system sweeper",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "0"
},
{
"model": "forefront security for sharepoint server",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "1.0"
},
{
"model": "forefront security for exchange server",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "1.0"
},
{
"model": "forefront client security",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "0"
},
{
"model": "antigen for smtp gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "9"
},
{
"model": "antigen for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "9"
}
],
"sources": [
{
"db": "BID",
"id": "29060"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001359"
},
{
"db": "NVD",
"id": "CVE-2008-1437"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-118"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:forefront_security_for_exchange_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:forefront_security_for_sharepoint:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:antigen_for_exchange:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:antigen_for_smtp_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:windows_defender:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:windows_live_onecare:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:diagnostics_and_recovery_toolkit:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:forefront_client_security:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:malware_protection_engine:0.1.13.192:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:malware_protection_engine:1.1.3520.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2008-1437"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sowhat smaillist@gmail.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200805-118"
}
],
"trust": 0.6
},
"cve": "CVE-2008-1437",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2008-1437",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-31562",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2008-1437",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200805-118",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-31562",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31562"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001359"
},
{
"db": "NVD",
"id": "CVE-2008-1437"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-118"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (engine hang and restart) via a crafted file, a different vulnerability than CVE-2008-1438. \nAttackers can exploit this issue to cause an affected computer to stop responding or to restart. Successful attacks will deny service to legitimate users. ----------------------------------------------------------------------\n\nSecunia Network Software Inspector 2.0 (NSI) - Public Beta\n\nThe Public Beta has ended. Thanks to all that participated. \n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits SoWhat, Nevis Labs. \n\nORIGINAL ADVISORY:\nMS08-029 (KB952044):\nhttp://www.microsoft.com/technet/security/Bulletin/MS08-029.mspx\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. Microsoft Malware Protection Engine TWO DoS Vulnerabilities\n\n\nBy Sowhat of Nevis Labs\nDate: 2008.05.14\n\nhttp://www.nevisnetworks.com\nhttp://secway.org/advisory/AD20080514.txt\n\nCVE: CVE-2008-1437\n CVE-2008-1438\n\nVendor\nMicrosoft\n\nAffected:\nWindows Live OneCare\nMicrosoft Antigen for Exchange\nMicrosoft Antigen for SMTP Gateway\nMicrosoft Windows Defender\nMicrosoft Forefront Client Security\nMicrosoft Forefront Security for Exchange Server\nMicrosoft Forefront Security for SharePoint\nStandalone System Sweeper located in Diagnostics and Recovery Toolset 6.0\n\n\nDetails:\n\nThere are two vulnerabilities idenitified in Microsoft Antivirus product. \nThese vulnerabilities can be exploited to cause Denial of service. \n\n1. CVE-2008-1437 PE Parsing Memory Corruption\nWhile scanning a specially crafted PE file, Malware orotection engine\n(MsMpEng.exe/mpengine.dll for Windows Live OneCare) will crash. \n\nCurrently, There\u0027s no evidence of code execution found. \n\nPlease note that this vulnerability can be triggered in various ways:\na. by sending emails to target mail server which is protected by MS\nantivirus\nb. by sending emails to victim who is using Windows Onecare or Windows\nDefender. \nc. by convining the victim to visit some websites. \nd. by sending files (can be any extension) to victims through P2P/IM. \n\nReal Time protection is enabled by default, so in the case b\u0026c, the\nvulnerability\ncan be exploited without any further user interaction after the victim\nrecieved\nthe email or opened the website. \n\n\n2. CVE-2008-1438 PE Parsing Disk Space D.o.S\nWhile parsing a specially crafted file with a malformed \"size of header\"\nis scanned by Microsoft Windows OneCare, there will be Disk Space DOS\ncondition. \n\nMicrosoft Malware protection engine will allocate disk space as much as the\nPE file\n\"claimed\", It can \"eat\" several Gb disk space of Windows installation\ndriver. \n\n\n\nProof of Concept:\nNo POC will be released. \n\n\nFix:\nMicrosoft has released an update address this issue. \nhttp://www.microsoft.com/technet/security/Bulletin/MS08-029.mspx\n\nVendor Response:\n\n2008.04.18 Vendor notified via email\n2008.04.18 Vendor response, developing for patch\n2008.05.14 Patch Release\n2008.05.14 Advisory released\n\n-- \nSowhat\nhttp://secway.org\n\"Life is like a bug, Do you know how to exploit it ?\"\n. The most severe\n vulnerabilities could allow a remote, unauthenticated attacker to\n execute arbitrary code. \n\n\nII. Impact\n\n A remote, unauthenticated attacker could execute arbitrary code, gain\n elevated privileges, or cause a denial of service. \n\n\nIII. Solution\n\nApply updates from Microsoft\n\n Microsoft has provided updates for these vulnerabilities in the May\n 2008 Security Bulletin Summary. The security bulletin describes any\n known issues related to the updates. Administrators are encouraged to\n note these issues and test for any potentially adverse effects. \n Administrators should consider using an automated update distribution\n system such as Windows Server Update Services (WSUS). \n\n\nIV. References\n\n * US-CERT Vulnerability Notes for Microsoft May 2008 updates -\n \u003chttp://www.kb.cert.org/vuls/byid?searchview\u0026query=ms08-may\u003e\n * Microsoft Security Bulletin Summary for May 2008 -\n \u003chttp://www.microsoft.com/technet/security/bulletin/ms08-may.mspx\u003e\n * Microsoft Update -\n \u003chttps://www.update.microsoft.com/microsoftupdate/\u003e\n * Windows Server Update Services -\n \u003chttp://www.microsoft.com/windowsserversystem/updateservices/default.mspx\u003e\n\n ____________________________________________________________________\n\n The most recent version of this document can be found at:\n\n \u003chttp://www.us-cert.gov/cas/techalerts/TA08-134A.html\u003e\n ____________________________________________________________________\n\n Feedback can be directed to US-CERT Technical Staff. Please send\n email to \u003ccert@cert.org\u003e with \"TA08-134A Feedback VU#534907\" in the\n subject. \n ____________________________________________________________________\n\n For instructions on subscribing to or unsubscribing from this\n mailing list, visit \u003chttp://www.us-cert.gov/cas/signup.html\u003e. \n ____________________________________________________________________\n\n Produced 2008 by US-CERT, a government organization. \n\n Terms of use:\n\n \u003chttp://www.us-cert.gov/legal.html\u003e\n ____________________________________________________________________\n\n \n Revision History\n\n May 13, 2008: Initial release\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.2.1 (GNU/Linux)\n\niQEVAwUBSCnrE/RFkHkM87XOAQJAoAf/XrkJlT9AS30/CZwAMO9qta8TbtLQTZR3\n/yAV/h2CmOKhFsbjdh8L4+GcP0n66twWhmMBfBs6BosOoaqqhkeJcE6JoyQ2Kso1\nMnhXjPJuGtgEPcfYX9bg42rnZ5WDXGh9EuhoZVyUV4UeUQ8qRM8LL3OIWBHubE7R\nfcOqIVDz/qtCC1U+RUdrbdeV8XB48mshiLoWjxzOT0FzeOKsBwsyHzaO5mAeEy4E\n1hsLC2u4idGlq9Ezl82XODyH6vtHBKq7yKDv+FkVHbCqwB+thqPkUo2es+amASra\nshcJggg39WWmPWphqnBz94rkdwitsvW3ymOWt1F27GecX1sveofLDQ==\n=rhf4\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-1437"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001359"
},
{
"db": "BID",
"id": "29060"
},
{
"db": "VULHUB",
"id": "VHN-31562"
},
{
"db": "PACKETSTORM",
"id": "66305"
},
{
"db": "PACKETSTORM",
"id": "66402"
},
{
"db": "PACKETSTORM",
"id": "66311"
}
],
"trust": 2.25
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-31562",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31562"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-1437",
"trust": 2.9
},
{
"db": "BID",
"id": "29060",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "30172",
"trust": 2.6
},
{
"db": "USCERT",
"id": "TA08-134A",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1020016",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2008-1506",
"trust": 1.7
},
{
"db": "USCERT",
"id": "SA08-134A",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001359",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200805-118",
"trust": 0.7
},
{
"db": "HP",
"id": "HPSBST02336",
"trust": 0.6
},
{
"db": "MS",
"id": "MS08-029",
"trust": 0.6
},
{
"db": "CERT/CC",
"id": "TA08-134A",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "66402",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-31562",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "66305",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "66311",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31562"
},
{
"db": "BID",
"id": "29060"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001359"
},
{
"db": "PACKETSTORM",
"id": "66305"
},
{
"db": "PACKETSTORM",
"id": "66402"
},
{
"db": "PACKETSTORM",
"id": "66311"
},
{
"db": "NVD",
"id": "CVE-2008-1437"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-118"
}
]
},
"id": "VAR-200805-0217",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-31562"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:26:50.002000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "MS08-029",
"trust": 0.8,
"url": "http://www.microsoft.com/technet/security/bulletin/ms08-029.mspx"
},
{
"title": "MS08-029",
"trust": 0.8,
"url": "http://www.microsoft.com/japan/technet/security/bulletin/ms08-029.mspx"
},
{
"title": "MS08-029e",
"trust": 0.8,
"url": "http://www.microsoft.com/japan/security/bulletins/ms08-029e.mspx"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001359"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-399",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31562"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001359"
},
{
"db": "NVD",
"id": "CVE-2008-1437"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/29060"
},
{
"trust": 2.5,
"url": "http://www.us-cert.gov/cas/techalerts/ta08-134a.html"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/30172"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id?1020016"
},
{
"trust": 1.6,
"url": "http://marc.info/?l=bugtraq\u0026m=121129490723574\u0026w=2"
},
{
"trust": 1.4,
"url": "http://www.frsirt.com/english/advisories/2008/1506/references"
},
{
"trust": 1.1,
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-029"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a13981"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2008/1506/references"
},
{
"trust": 1.1,
"url": "http://www.microsoft.com/technet/security/bulletin/ms08-029.mspx"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-1437"
},
{
"trust": 0.8,
"url": "http://www.jpcert.or.jp/at/2008/at080007.txt"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnta08-134a/index.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/tr/trta08-134a/"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1437"
},
{
"trust": 0.8,
"url": "http://securitytracker.com/alerts/2008/may/1020016.html"
},
{
"trust": 0.8,
"url": "http://www.us-cert.gov/cas/alerts/sa08-134a.html"
},
{
"trust": 0.8,
"url": "http://www.cyberpolice.go.jp/important/2008/20080514_110201.html"
},
{
"trust": 0.4,
"url": "http://secway.org/advisory/ad20080514.txt"
},
{
"trust": 0.3,
"url": "http://www.microsoft.com"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=121129490723574\u0026amp;w=2"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13488/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/network_software_inspector_2/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13487/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13422/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13486/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13464/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/30172/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/17290/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/18640/"
},
{
"trust": 0.1,
"url": "http://secway.org"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1437"
},
{
"trust": 0.1,
"url": "http://www.nevisnetworks.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1438"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/techalerts/ta08-134a.html\u003e"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/byid?searchview\u0026query=ms08-may\u003e"
},
{
"trust": 0.1,
"url": "http://www.microsoft.com/technet/security/bulletin/ms08-may.mspx\u003e"
},
{
"trust": 0.1,
"url": "http://www.microsoft.com/windowsserversystem/updateservices/default.mspx\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/signup.html\u003e."
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/legal.html\u003e"
},
{
"trust": 0.1,
"url": "https://www.update.microsoft.com/microsoftupdate/\u003e"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31562"
},
{
"db": "BID",
"id": "29060"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001359"
},
{
"db": "PACKETSTORM",
"id": "66305"
},
{
"db": "PACKETSTORM",
"id": "66402"
},
{
"db": "PACKETSTORM",
"id": "66311"
},
{
"db": "NVD",
"id": "CVE-2008-1437"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-118"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-31562"
},
{
"db": "BID",
"id": "29060"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001359"
},
{
"db": "PACKETSTORM",
"id": "66305"
},
{
"db": "PACKETSTORM",
"id": "66402"
},
{
"db": "PACKETSTORM",
"id": "66311"
},
{
"db": "NVD",
"id": "CVE-2008-1437"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-118"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-05-13T00:00:00",
"db": "VULHUB",
"id": "VHN-31562"
},
{
"date": "2008-05-13T00:00:00",
"db": "BID",
"id": "29060"
},
{
"date": "2008-06-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001359"
},
{
"date": "2008-05-13T19:35:09",
"db": "PACKETSTORM",
"id": "66305"
},
{
"date": "2008-05-15T07:54:53",
"db": "PACKETSTORM",
"id": "66402"
},
{
"date": "2008-05-13T19:41:07",
"db": "PACKETSTORM",
"id": "66311"
},
{
"date": "2008-05-13T22:20:00",
"db": "NVD",
"id": "CVE-2008-1437"
},
{
"date": "2008-05-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200805-118"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-12T00:00:00",
"db": "VULHUB",
"id": "VHN-31562"
},
{
"date": "2008-05-14T17:05:00",
"db": "BID",
"id": "29060"
},
{
"date": "2008-06-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001359"
},
{
"date": "2018-10-12T21:45:24.460000",
"db": "NVD",
"id": "CVE-2008-1437"
},
{
"date": "2008-09-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200805-118"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "66311"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-118"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Microsoft Malware Protection Engine Service disruption in (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001359"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200805-118"
}
],
"trust": 0.6
}
}
var-200805-0218
Vulnerability from variot
Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (disk space exhaustion) via a file with "crafted data structures" that trigger the creation of large temporary files, a different vulnerability than CVE-2008-1437. (DoS) There is a vulnerability that becomes a condition.The processing of a file crafted by a third party can create a large temporary file that can run out of disk space. Attackers can exploit this issue to cause an affected computer to stop responding or to restart. Successful attacks will deny service to legitimate users. ----------------------------------------------------------------------
Secunia Network Software Inspector 2.0 (NSI) - Public Beta
The Public Beta has ended. Thanks to all that participated.
PROVIDED AND/OR DISCOVERED BY: The vendor credits SoWhat, Nevis Labs.
ORIGINAL ADVISORY: MS08-029 (KB952044): http://www.microsoft.com/technet/security/Bulletin/MS08-029.mspx
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. Microsoft Malware Protection Engine TWO DoS Vulnerabilities
By Sowhat of Nevis Labs Date: 2008.05.14
http://www.nevisnetworks.com http://secway.org/advisory/AD20080514.txt
CVE: CVE-2008-1437 CVE-2008-1438
Vendor Microsoft
Affected: Windows Live OneCare Microsoft Antigen for Exchange Microsoft Antigen for SMTP Gateway Microsoft Windows Defender Microsoft Forefront Client Security Microsoft Forefront Security for Exchange Server Microsoft Forefront Security for SharePoint Standalone System Sweeper located in Diagnostics and Recovery Toolset 6.0
Details:
There are two vulnerabilities idenitified in Microsoft Antivirus product. These vulnerabilities can be exploited to cause Denial of service.
- CVE-2008-1437 PE Parsing Memory Corruption While scanning a specially crafted PE file, Malware orotection engine (MsMpEng.exe/mpengine.dll for Windows Live OneCare) will crash.
Currently, There's no evidence of code execution found.
Please note that this vulnerability can be triggered in various ways: a. by sending emails to target mail server which is protected by MS antivirus b. by sending emails to victim who is using Windows Onecare or Windows Defender. c. by convining the victim to visit some websites. d. by sending files (can be any extension) to victims through P2P/IM.
Real Time protection is enabled by default, so in the case b&c, the vulnerability can be exploited without any further user interaction after the victim recieved the email or opened the website.
Proof of Concept: No POC will be released.
Fix: Microsoft has released an update address this issue. http://www.microsoft.com/technet/security/Bulletin/MS08-029.mspx
Vendor Response:
2008.04.18 Vendor notified via email 2008.04.18 Vendor response, developing for patch 2008.05.14 Patch Release 2008.05.14 Advisory released
-- Sowhat http://secway.org "Life is like a bug, Do you know how to exploit it ?" . The most severe vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code.
II. Impact
A remote, unauthenticated attacker could execute arbitrary code, gain elevated privileges, or cause a denial of service.
III. Solution
Apply updates from Microsoft
Microsoft has provided updates for these vulnerabilities in the May 2008 Security Bulletin Summary. The security bulletin describes any known issues related to the updates. Administrators are encouraged to note these issues and test for any potentially adverse effects. Administrators should consider using an automated update distribution system such as Windows Server Update Services (WSUS).
IV. References
* US-CERT Vulnerability Notes for Microsoft May 2008 updates -
<http://www.kb.cert.org/vuls/byid?searchview&query=ms08-may>
* Microsoft Security Bulletin Summary for May 2008 -
<http://www.microsoft.com/technet/security/bulletin/ms08-may.mspx>
* Microsoft Update -
<https://www.update.microsoft.com/microsoftupdate/>
* Windows Server Update Services -
<http://www.microsoft.com/windowsserversystem/updateservices/default.mspx>
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/techalerts/TA08-134A.html>
Feedback can be directed to US-CERT Technical Staff. Please send email to cert@cert.org with "TA08-134A Feedback VU#534907" in the subject.
For instructions on subscribing to or unsubscribing from this mailing list, visit http://www.us-cert.gov/cas/signup.html.
Produced 2008 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
Revision History
May 13, 2008: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBSCnrE/RFkHkM87XOAQJAoAf/XrkJlT9AS30/CZwAMO9qta8TbtLQTZR3 /yAV/h2CmOKhFsbjdh8L4+GcP0n66twWhmMBfBs6BosOoaqqhkeJcE6JoyQ2Kso1 MnhXjPJuGtgEPcfYX9bg42rnZ5WDXGh9EuhoZVyUV4UeUQ8qRM8LL3OIWBHubE7R fcOqIVDz/qtCC1U+RUdrbdeV8XB48mshiLoWjxzOT0FzeOKsBwsyHzaO5mAeEy4E 1hsLC2u4idGlq9Ezl82XODyH6vtHBKq7yKDv+FkVHbCqwB+thqPkUo2es+amASra shcJggg39WWmPWphqnBz94rkdwitsvW3ymOWt1F27GecX1sveofLDQ== =rhf4 -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200805-0218",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "malware protection engine",
"scope": "eq",
"trust": 1.6,
"vendor": "microsoft",
"version": "0.1.13.192"
},
{
"model": "malware protection engine",
"scope": "eq",
"trust": 1.6,
"vendor": "microsoft",
"version": "1.1.3520.0"
},
{
"model": "diagnostics and recovery toolkit",
"scope": "eq",
"trust": 1.6,
"vendor": "microsoft",
"version": "6.0"
},
{
"model": "forefront client security",
"scope": null,
"trust": 1.4,
"vendor": "microsoft",
"version": null
},
{
"model": "windows defender",
"scope": null,
"trust": 1.4,
"vendor": "microsoft",
"version": null
},
{
"model": "windows live onecare",
"scope": null,
"trust": 1.4,
"vendor": "microsoft",
"version": null
},
{
"model": "forefront client security",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "forefront security for exchange server",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "forefront security for sharepoint",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "windows defender",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "windows live onecare",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "antigen for smtp gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "antigen for exchange",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "*"
},
{
"model": "diagnostics and recovery toolset",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "6.0"
},
{
"model": "antigen",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "for exchange"
},
{
"model": "antigen",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "for smtp gateway"
},
{
"model": "forefront security",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "for exchange server"
},
{
"model": "forefront security",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "for sharepoint"
},
{
"model": "forefront security for exchange server",
"scope": null,
"trust": 0.6,
"vendor": "microsoft",
"version": null
},
{
"model": "antigen for exchange",
"scope": null,
"trust": 0.6,
"vendor": "microsoft",
"version": null
},
{
"model": "forefront security for sharepoint",
"scope": null,
"trust": 0.6,
"vendor": "microsoft",
"version": null
},
{
"model": "antigen for smtp gateway",
"scope": null,
"trust": 0.6,
"vendor": "microsoft",
"version": null
},
{
"model": "windows live onecare",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "0"
},
{
"model": "windows defender edition",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "x640"
},
{
"model": "windows defender",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "0"
},
{
"model": "standalone system sweeper",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "0"
},
{
"model": "forefront security for sharepoint server",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "1.0"
},
{
"model": "forefront security for exchange server",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "1.0"
},
{
"model": "forefront client security",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "0"
},
{
"model": "antigen for smtp gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "9"
},
{
"model": "antigen for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "9"
}
],
"sources": [
{
"db": "BID",
"id": "29073"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001358"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-119"
},
{
"db": "NVD",
"id": "CVE-2008-1438"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:malware_protection_engine:1.1.3520.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:windows_defender:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:diagnostics_and_recovery_toolkit:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:forefront_client_security:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:forefront_security_for_exchange_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:forefront_security_for_sharepoint:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:malware_protection_engine:0.1.13.192:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:antigen_for_exchange:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:antigen_for_smtp_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:windows_live_onecare:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2008-1438"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sowhat smaillist@gmail.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200805-119"
}
],
"trust": 0.6
},
"cve": "CVE-2008-1438",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2008-1438",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-31563",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2008-1438",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200805-119",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-31563",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2008-1438",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31563"
},
{
"db": "VULMON",
"id": "CVE-2008-1438"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001358"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-119"
},
{
"db": "NVD",
"id": "CVE-2008-1438"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (disk space exhaustion) via a file with \"crafted data structures\" that trigger the creation of large temporary files, a different vulnerability than CVE-2008-1437. (DoS) There is a vulnerability that becomes a condition.The processing of a file crafted by a third party can create a large temporary file that can run out of disk space. \nAttackers can exploit this issue to cause an affected computer to stop responding or to restart. Successful attacks will deny service to legitimate users. ----------------------------------------------------------------------\n\nSecunia Network Software Inspector 2.0 (NSI) - Public Beta\n\nThe Public Beta has ended. Thanks to all that participated. \n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits SoWhat, Nevis Labs. \n\nORIGINAL ADVISORY:\nMS08-029 (KB952044):\nhttp://www.microsoft.com/technet/security/Bulletin/MS08-029.mspx\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. Microsoft Malware Protection Engine TWO DoS Vulnerabilities\n\n\nBy Sowhat of Nevis Labs\nDate: 2008.05.14\n\nhttp://www.nevisnetworks.com\nhttp://secway.org/advisory/AD20080514.txt\n\nCVE: CVE-2008-1437\n CVE-2008-1438\n\nVendor\nMicrosoft\n\nAffected:\nWindows Live OneCare\nMicrosoft Antigen for Exchange\nMicrosoft Antigen for SMTP Gateway\nMicrosoft Windows Defender\nMicrosoft Forefront Client Security\nMicrosoft Forefront Security for Exchange Server\nMicrosoft Forefront Security for SharePoint\nStandalone System Sweeper located in Diagnostics and Recovery Toolset 6.0\n\n\nDetails:\n\nThere are two vulnerabilities idenitified in Microsoft Antivirus product. \nThese vulnerabilities can be exploited to cause Denial of service. \n\n1. CVE-2008-1437 PE Parsing Memory Corruption\nWhile scanning a specially crafted PE file, Malware orotection engine\n(MsMpEng.exe/mpengine.dll for Windows Live OneCare) will crash. \n\nCurrently, There\u0027s no evidence of code execution found. \n\nPlease note that this vulnerability can be triggered in various ways:\na. by sending emails to target mail server which is protected by MS\nantivirus\nb. by sending emails to victim who is using Windows Onecare or Windows\nDefender. \nc. by convining the victim to visit some websites. \nd. by sending files (can be any extension) to victims through P2P/IM. \n\nReal Time protection is enabled by default, so in the case b\u0026c, the\nvulnerability\ncan be exploited without any further user interaction after the victim\nrecieved\nthe email or opened the website. \n\n\n2. \n\n\n\nProof of Concept:\nNo POC will be released. \n\n\nFix:\nMicrosoft has released an update address this issue. \nhttp://www.microsoft.com/technet/security/Bulletin/MS08-029.mspx\n\nVendor Response:\n\n2008.04.18 Vendor notified via email\n2008.04.18 Vendor response, developing for patch\n2008.05.14 Patch Release\n2008.05.14 Advisory released\n\n-- \nSowhat\nhttp://secway.org\n\"Life is like a bug, Do you know how to exploit it ?\"\n. The most severe\n vulnerabilities could allow a remote, unauthenticated attacker to\n execute arbitrary code. \n\n\nII. Impact\n\n A remote, unauthenticated attacker could execute arbitrary code, gain\n elevated privileges, or cause a denial of service. \n\n\nIII. Solution\n\nApply updates from Microsoft\n\n Microsoft has provided updates for these vulnerabilities in the May\n 2008 Security Bulletin Summary. The security bulletin describes any\n known issues related to the updates. Administrators are encouraged to\n note these issues and test for any potentially adverse effects. \n Administrators should consider using an automated update distribution\n system such as Windows Server Update Services (WSUS). \n\n\nIV. References\n\n * US-CERT Vulnerability Notes for Microsoft May 2008 updates -\n \u003chttp://www.kb.cert.org/vuls/byid?searchview\u0026query=ms08-may\u003e\n * Microsoft Security Bulletin Summary for May 2008 -\n \u003chttp://www.microsoft.com/technet/security/bulletin/ms08-may.mspx\u003e\n * Microsoft Update -\n \u003chttps://www.update.microsoft.com/microsoftupdate/\u003e\n * Windows Server Update Services -\n \u003chttp://www.microsoft.com/windowsserversystem/updateservices/default.mspx\u003e\n\n ____________________________________________________________________\n\n The most recent version of this document can be found at:\n\n \u003chttp://www.us-cert.gov/cas/techalerts/TA08-134A.html\u003e\n ____________________________________________________________________\n\n Feedback can be directed to US-CERT Technical Staff. Please send\n email to \u003ccert@cert.org\u003e with \"TA08-134A Feedback VU#534907\" in the\n subject. \n ____________________________________________________________________\n\n For instructions on subscribing to or unsubscribing from this\n mailing list, visit \u003chttp://www.us-cert.gov/cas/signup.html\u003e. \n ____________________________________________________________________\n\n Produced 2008 by US-CERT, a government organization. \n\n Terms of use:\n\n \u003chttp://www.us-cert.gov/legal.html\u003e\n ____________________________________________________________________\n\n \n Revision History\n\n May 13, 2008: Initial release\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.2.1 (GNU/Linux)\n\niQEVAwUBSCnrE/RFkHkM87XOAQJAoAf/XrkJlT9AS30/CZwAMO9qta8TbtLQTZR3\n/yAV/h2CmOKhFsbjdh8L4+GcP0n66twWhmMBfBs6BosOoaqqhkeJcE6JoyQ2Kso1\nMnhXjPJuGtgEPcfYX9bg42rnZ5WDXGh9EuhoZVyUV4UeUQ8qRM8LL3OIWBHubE7R\nfcOqIVDz/qtCC1U+RUdrbdeV8XB48mshiLoWjxzOT0FzeOKsBwsyHzaO5mAeEy4E\n1hsLC2u4idGlq9Ezl82XODyH6vtHBKq7yKDv+FkVHbCqwB+thqPkUo2es+amASra\nshcJggg39WWmPWphqnBz94rkdwitsvW3ymOWt1F27GecX1sveofLDQ==\n=rhf4\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-1438"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001358"
},
{
"db": "BID",
"id": "29073"
},
{
"db": "VULHUB",
"id": "VHN-31563"
},
{
"db": "VULMON",
"id": "CVE-2008-1438"
},
{
"db": "PACKETSTORM",
"id": "66305"
},
{
"db": "PACKETSTORM",
"id": "66402"
},
{
"db": "PACKETSTORM",
"id": "66311"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-1438",
"trust": 3.0
},
{
"db": "BID",
"id": "29073",
"trust": 2.9
},
{
"db": "SECUNIA",
"id": "30172",
"trust": 2.7
},
{
"db": "USCERT",
"id": "TA08-134A",
"trust": 2.7
},
{
"db": "SECTRACK",
"id": "1020016",
"trust": 2.6
},
{
"db": "VUPEN",
"id": "ADV-2008-1506",
"trust": 1.8
},
{
"db": "USCERT",
"id": "SA08-134A",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001358",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200805-119",
"trust": 0.7
},
{
"db": "MS",
"id": "MS08-029",
"trust": 0.6
},
{
"db": "HP",
"id": "SSRT080071",
"trust": 0.6
},
{
"db": "CERT/CC",
"id": "TA08-134A",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-31563",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2008-1438",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "66305",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "66402",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "66311",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31563"
},
{
"db": "VULMON",
"id": "CVE-2008-1438"
},
{
"db": "BID",
"id": "29073"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001358"
},
{
"db": "PACKETSTORM",
"id": "66305"
},
{
"db": "PACKETSTORM",
"id": "66402"
},
{
"db": "PACKETSTORM",
"id": "66311"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-119"
},
{
"db": "NVD",
"id": "CVE-2008-1438"
}
]
},
"id": "VAR-200805-0218",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-31563"
}
],
"trust": 0.01
},
"last_update_date": "2024-02-13T22:12:03.084000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "MS08-029",
"trust": 0.8,
"url": "http://www.microsoft.com/technet/security/bulletin/ms08-029.mspx"
},
{
"title": "MS08-029",
"trust": 0.8,
"url": "http://www.microsoft.com/japan/technet/security/bulletin/ms08-029.mspx"
},
{
"title": "MS08-029e",
"trust": 0.8,
"url": "http://www.microsoft.com/japan/security/bulletins/ms08-029e.mspx"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001358"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-399",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31563"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001358"
},
{
"db": "NVD",
"id": "CVE-2008-1438"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "http://www.securityfocus.com/bid/29073"
},
{
"trust": 2.6,
"url": "http://www.us-cert.gov/cas/techalerts/ta08-134a.html"
},
{
"trust": 2.6,
"url": "http://secunia.com/advisories/30172"
},
{
"trust": 1.8,
"url": "http://www.securitytracker.com/id?1020016"
},
{
"trust": 1.7,
"url": "http://marc.info/?l=bugtraq\u0026m=121129490723574\u0026w=2"
},
{
"trust": 1.4,
"url": "http://www.frsirt.com/english/advisories/2008/1506/references"
},
{
"trust": 1.2,
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-029"
},
{
"trust": 1.2,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a14375"
},
{
"trust": 1.2,
"url": "http://www.vupen.com/english/advisories/2008/1506/references"
},
{
"trust": 1.1,
"url": "http://www.microsoft.com/technet/security/bulletin/ms08-029.mspx"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-1438"
},
{
"trust": 0.8,
"url": "http://www.jpcert.or.jp/at/2008/at080007.txt"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnta08-134a/index.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/tr/trta08-134a"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1438"
},
{
"trust": 0.8,
"url": "http://securitytracker.com/alerts/2008/may/1020016.html"
},
{
"trust": 0.8,
"url": "http://www.us-cert.gov/cas/alerts/sa08-134a.html"
},
{
"trust": 0.8,
"url": "http://www.cyberpolice.go.jp/important/2008/20080514_110201.html"
},
{
"trust": 0.4,
"url": "http://secway.org/advisory/ad20080514.txt"
},
{
"trust": 0.3,
"url": "http://www.microsoft.com"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=121129490723574\u0026amp;w=2"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/399.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13488/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/network_software_inspector_2/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13487/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13422/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13486/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13464/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/30172/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/17290/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/18640/"
},
{
"trust": 0.1,
"url": "http://secway.org"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1437"
},
{
"trust": 0.1,
"url": "http://www.nevisnetworks.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-1438"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/techalerts/ta08-134a.html\u003e"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/byid?searchview\u0026query=ms08-may\u003e"
},
{
"trust": 0.1,
"url": "http://www.microsoft.com/technet/security/bulletin/ms08-may.mspx\u003e"
},
{
"trust": 0.1,
"url": "http://www.microsoft.com/windowsserversystem/updateservices/default.mspx\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/signup.html\u003e."
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/legal.html\u003e"
},
{
"trust": 0.1,
"url": "https://www.update.microsoft.com/microsoftupdate/\u003e"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31563"
},
{
"db": "VULMON",
"id": "CVE-2008-1438"
},
{
"db": "BID",
"id": "29073"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001358"
},
{
"db": "PACKETSTORM",
"id": "66305"
},
{
"db": "PACKETSTORM",
"id": "66402"
},
{
"db": "PACKETSTORM",
"id": "66311"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-119"
},
{
"db": "NVD",
"id": "CVE-2008-1438"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-31563"
},
{
"db": "VULMON",
"id": "CVE-2008-1438"
},
{
"db": "BID",
"id": "29073"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001358"
},
{
"db": "PACKETSTORM",
"id": "66305"
},
{
"db": "PACKETSTORM",
"id": "66402"
},
{
"db": "PACKETSTORM",
"id": "66311"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-119"
},
{
"db": "NVD",
"id": "CVE-2008-1438"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-05-13T00:00:00",
"db": "VULHUB",
"id": "VHN-31563"
},
{
"date": "2008-05-13T00:00:00",
"db": "VULMON",
"id": "CVE-2008-1438"
},
{
"date": "2008-05-13T00:00:00",
"db": "BID",
"id": "29073"
},
{
"date": "2008-06-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001358"
},
{
"date": "2008-05-13T19:35:09",
"db": "PACKETSTORM",
"id": "66305"
},
{
"date": "2008-05-15T07:54:53",
"db": "PACKETSTORM",
"id": "66402"
},
{
"date": "2008-05-13T19:41:07",
"db": "PACKETSTORM",
"id": "66311"
},
{
"date": "2008-05-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200805-119"
},
{
"date": "2008-05-13T22:20:00",
"db": "NVD",
"id": "CVE-2008-1438"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-12T00:00:00",
"db": "VULHUB",
"id": "VHN-31563"
},
{
"date": "2018-10-12T00:00:00",
"db": "VULMON",
"id": "CVE-2008-1438"
},
{
"date": "2008-05-14T16:55:00",
"db": "BID",
"id": "29073"
},
{
"date": "2011-03-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001358"
},
{
"date": "2008-09-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200805-119"
},
{
"date": "2018-10-12T21:45:25.273000",
"db": "NVD",
"id": "CVE-2008-1438"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "66311"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-119"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Microsoft Malware Protection Engine Service disruption related to temporary file creation (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001358"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200805-119"
}
],
"trust": 0.6
}
}