← Back

CVE-2008-4037

nvd nist
Published: Nov 12, 2008Modified: Apr 23, 2026

JSON object

Loading...
9.3
Vector
AV:N/AC:M/Au:N/C:C/I:C/A:C
Exploitability: 8.6 / Impact: 10.0
Source: NVD

Description

Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka "SMB Credential Reflection Vulnerability." NOTE: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834.

Affected (17)

Microsoft
4 products
Windows
Windows 2000
Windows Server 2008
Windows Vista
Configuration A
17 vulnerable
Vulnerable SoftwareAffected Versions
Microsoft
Windows
Version server_2003 sp1
Windows
Version server_2003 sp1
Windows
Version server_2003 sp2
Windows
Version server_2003 sp2
Windows
Version server_2003 sp2
Windows
Version server_2003 unknown
Windows
Version xp sp2
Windows
Version xp sp2
Windows
Version xp sp3
Windows
Version xp unknown
Windows 2000
All versions
Microsoft
Windows Server 2008
All versions
Windows Server 2008
All versions
Windows Server 2008
All versions
Microsoft
Windows Vista
All versions
Windows Vista
All versions
Windows Vista
All versions

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (30)

Source: secure@microsoft.com
Source: secure@microsoft.com
Source: secure@microsoft.com
Vendor Advisory
Source: secure@microsoft.com
Source: secure@microsoft.com
Source: secure@microsoft.com
ExploitPatch
Source: secure@microsoft.com
Exploit
Source: secure@microsoft.com
Exploit
Source: secure@microsoft.com
US Government Resource
Source: secure@microsoft.com
Source: secure@microsoft.com
Vendor Advisory
Source: secure@microsoft.com
Source: secure@microsoft.com
Source: secure@microsoft.com
Source: secure@microsoft.com
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitPatch
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
US Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.