CVE-2008-2547 Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows Installer allows context-dependent attackers to execute arbitrary code via a long GUID value for the /x...
HighCVSS 9.3
EPSS 8.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows Installer allows context-dependent attackers to execute arbitrary code via a long GUID value for the /x (aka /uninstall) option. NOTE: this issue might cross privilege boundaries if msiexec.exe is reachable via components such as ActiveX controls, and might additionally require a separate vulnerability in the control.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows installer | All versions | No fix listed |
| Microsoft windows installer | = 3.1.4000.1823 | No fix listed |
| Microsoft windows installer | = 4.5.6001.22159 | No fix listed |
References
- www.aushack.com exploit
- 20080603 Windows Installer msiexec GUID Buffer Overflow mailing-list
- 20080603 Re: Windows Installer msiexec GUID Buffer Overflow mailing-list
- 20080603 RE: Windows Installer msiexec GUID Buffer Overflow mailing-list
- win-msiexec-bo(42887) vdb-entry