CVE-2008-3466

Description

Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS Command Execution Vulnerability."

References

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6075

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-059

http://www.vupen.com/english/advisories/2008/2810

http://www.us-cert.gov/cas/techalerts/TA08-288A.html

http://www.securitytracker.com/id?1021043

http://secunia.com/advisories/32233

http://marc.info/?l=bugtraq&m=122479227205998&w=2

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3