CVE-2008-1451

Published: Jun 12, 2008Modified: Apr 23, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

The WINS service on Microsoft Windows 2000 SP4, and Server 2003 SP1 and SP2, does not properly validate data structures in WINS network packets, which allows local users to gain privileges via a crafted packet, aka "Memory Overwrite Vulnerability."

Affected (3)

Products: Microsoft: Windows 2000, Windows 2003 Server

Microsoft

2 products

Windows 2000

Windows 2003 Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 2000	All versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows 2003 Server	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (14)

http://secunia.com/advisories/30584

Source: secure@microsoft.com

Vendor Advisory

http://securitytracker.com/id?1020228

Source: secure@microsoft.com

Patch

http://www.securityfocus.com/bid/29588

Source: secure@microsoft.com

ExploitPatch

http://www.us-cert.gov/cas/techalerts/TA08-162B.html

Source: secure@microsoft.com

US Government Resource

http://www.vupen.com/english/advisories/2008/1781

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-034

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5582

Source: secure@microsoft.com

http://secunia.com/advisories/30584