Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 98.8%; technical severity is CVSS 9.8.
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."
Who should care
- Teams operating Windows, Windows 2000, Windows Server 2003 +3 more
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Windows, Windows 2000, Windows Server 2003 +3 more is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Vendor remediation
Patch and remediation links
Use the vendor source below to confirm the correct fixed version, package or mitigation for your affected product.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-94
- Affected versions
- Microsoft Windows; Microsoft Windows 2000 (Version: -); Microsoft Windows Server 2003 (Version: -); Microsoft Windows Server 2008 (Version: -); Microsoft Windows Vista (Version: -); Microsoft Windows Xp (Version: -)
- Published
- 23 October 2008
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 98.8%
- Signal calculated at 85
External references
- Government advisory from www.cisa.gov
- Technical reference from blogs.securiteam.com
- Third-party advisory from marc.info
- Government advisory from www.kb.cert.org
- Third-party advisory from www.securityfocus.com
- Third-party advisory from www.securityfocus.com
- Third-party advisory from www.securitytracker.com
- Government advisory from www.us-cert.gov
- Government advisory from www.us-cert.gov
- Vendor advisory from www.vupen.com
- Third-party advisory from exchange.xforce.ibmcloud.com
- Third-party advisory from oval.cisecurity.org