CVE-2008-3466 Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary program...
HighCVSS 10.0
EPSS 77.7%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS Command Execution Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft host integration server 2000 | All versions | No fix listed |
| Microsoft host integration server 2004 | All versions | No fix listed |
| Microsoft host integration server 2006 | All versions | No fix listed |
References
- 20081014 Microsoft Host Integration Server 2006 Command Execution Vulnerability third-party-advisory
- SSRT080143 vendor-advisory
- 32233 patch third-party-advisory vendor-advisory
- 31620 exploit patch vdb-entry
- 1021043 vdb-entry
- TA08-288A third-party-advisory us-government-resource
- ADV-2008-2810 vdb-entry
- MS08-059 vendor-advisory
- oval:org.mitre.oval:def:6075 signature vdb-entry