CVE-2008-0083

The (1) VBScript (VBScript.dll) and (2) JScript (JScript.dll) scripting engines 5.1 and 5.6, as used in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2, do not properly decode script, which allows remote attackers to execute arbitrary code via unknown vectors.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://marc.info/?l=bugtraq&m=120845064910729&w=2
http://secunia.com/advisories/29712	Vendor Advisory
http://www.securityfocus.com/bid/28551	Patch
http://www.securitytracker.com/id?1019799
http://www.us-cert.gov/cas/techalerts/TA08-099A.html	US Government Resource
http://www.vupen.com/english/advisories/2008/1146/references	Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-022
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5495

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_2000::sp4::::::*
	cpe:2.3:o:microsoft:windows_2003_server:::x64:::::*
	cpe:2.3:o:microsoft:windows_2003_server::sp1::::::*
	cpe:2.3:o:microsoft:windows_2003_server::sp1:itanium:::::
	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
	cpe:2.3:o:microsoft:windows_2003_server::sp2:x64:::::
	cpe:2.3:o:microsoft:windows_xp:::x64:::::*
	cpe:2.3:o:microsoft:windows_xp::sp2::::::*
	cpe:2.3:o:microsoft:windows_xp::sp2:x64:::::

History

No history.

Information

Published : 2008-04-08 23:05

Updated : 2024-02-04 17:33

NVD link : CVE-2008-0083

Mitre link : CVE-2008-0083

CVE.ORG link : CVE-2008-0083

JSON object : View

Products Affected

microsoft

windows_xp
windows_2003_server
windows_2000

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2008-0083", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2008-04-08T23:05:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=120845064910729&w=2", "source": "secure@microsoft.com"}, {"url": "http://secunia.com/advisories/29712", "tags": ["Vendor Advisory"], "source": "secure@microsoft.com"}, {"url": "http://www.securityfocus.com/bid/28551", "tags": ["Patch"], "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id?1019799", "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA08-099A.html", "tags": ["US Government Resource"], "source": "secure@microsoft.com"}, {"url": "http://www.vupen.com/english/advisories/2008/1146/references", "tags": ["Vendor Advisory"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-022", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5495", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The (1) VBScript (VBScript.dll) and (2) JScript (JScript.dll) scripting engines 5.1 and 5.6, as used in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2, do not properly decode script, which allows remote attackers to execute arbitrary code via unknown vectors."}, {"lang": "es", "value": "Los motores de scripting (1) VBScript (VBScript.dll) y (2) JScript (JScript.dll) versiones 5.1 y 5.6, tal y como es usado en Microsoft Windows 2000 SP4, XP SP2 y Server 2003 SP1 y SP2, no descodifican apropiadamente el script, lo que permite a los atacantes remotos ejecutar c\u00f3digo arbitrario por medio de vectores de ataque desconocidos."}], "lastModified": "2018-10-12T21:44:44.037", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83E7C4A0-78CF-4B56-82BF-EC932BDD8ADF"}, {"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD264C73-360E-414D-BE22-192F92E5A0A3"}, {"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE8F4276-4D97-480D-A542-FE9982FFD765"}, {"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp1:itanium:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "972ADDBC-5D6E-48D5-9DB7-44FE0539807D"}, {"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2978BF86-5A1A-438E-B81F-F360D0E30C9C"}, {"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7EFB032-47F4-4497-B16B-CB9126EAC9DF"}, {"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6881476D-81A2-4DFD-AC77-82A8D08A0568"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACF75FC8-095A-4EEA-9A41-C27CFF3953FB"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B339C33-8896-4896-88FF-88E74FDBC543"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57ECAAA8-8709-4AC7-9CE7-49A8040C04D3"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}