CVE-2008-1440
Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets, which allows remote attackers to cause a denial of service (infinite loop and system hang)…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 22.6%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted PGM packet, aka the "PGM Invalid Length Vulnerability."
- CVSS 2.0
- 7.1 HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
- EPSS
- 22.59% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1284
- Affected
- microsoft/windows server 2003 · microsoft/windows xp
- Source
- secure@microsoft.com
References
- http://secunia.com/advisories/30587Broken Link, Permissions Required, Vendor Advisory
- http://securitytracker.com/id?1020230Broken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/29508Broken Link, Patch, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA08-162B.htmlBroken Link, Third Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2008/1783Broken Link
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-036Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5473Broken Link
- http://secunia.com/advisories/30587Broken Link, Permissions Required, Vendor Advisory
- http://securitytracker.com/id?1020230Broken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/29508Broken Link, Patch, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA08-162B.htmlBroken Link, Third Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2008/1783Broken Link
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-036Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5473Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.