CVE-2008-3466

Published: Oct 15, 2008Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS Command Execution Vulnerability."

Affected (7)

Products: Microsoft: Host Integration Server 2000, Host Integration Server 2004, Host Integration Server 2006

3 products

Host Integration Server 2000

Host Integration Server 2004

Host Integration Server 2006

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Microsoft Host Integration Server 2000	All versions
Microsoft Host Integration Server 2000	All versions
Microsoft Host Integration Server 2004	All versions
Microsoft Host Integration Server 2004	All versions
Microsoft Host Integration Server 2004	All versions
Microsoft Host Integration Server 2006	All versions
Microsoft Host Integration Server 2006	All versions

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (18)

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745

Source: secure@microsoft.com

http://marc.info/?l=bugtraq&m=122479227205998&w=2

Source: secure@microsoft.com

http://secunia.com/advisories/32233

Source: secure@microsoft.com

PatchVendor Advisory

http://www.securityfocus.com/bid/31620

Source: secure@microsoft.com

ExploitPatch

http://www.securitytracker.com/id?1021043

Source: secure@microsoft.com

http://www.us-cert.gov/cas/techalerts/TA08-288A.html

Source: secure@microsoft.com

US Government Resource

http://www.vupen.com/english/advisories/2008/2810

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-059

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6075

Source: secure@microsoft.com

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=122479227205998&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32233

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/bid/31620

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://www.securitytracker.com/id?1021043

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA08-288A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2008/2810

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-059

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6075

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.