CVE-2008-4037: Critical severity microsoft windows operating system vulnerability

Published Nov 12, 2008

Updated

Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka "SMB Credential Reflection Vulnerability." NOTE: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834.

Affected Software

18 affected components

Microsoft Windows=server_2003-sp1

Microsoft Windows=server_2003-sp2

Microsoft Windows=server_2003-unknown

Microsoft Windows=xp-sp2

Microsoft Windows=xp-sp3

Microsoft Windows=xp-unknown

Microsoft Windows 2000=sp4

Microsoft Windows Server 2008

Microsoft Windows Vista

Microsoft Windows Vista=sp1

Remediation

Patch Available

http://www.securityfocus.com/bid/7385

Event History

Nov 12, 2008

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-4037?

CVE-2008-4037 is classified as a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2008-4037?

To mitigate CVE-2008-4037, users should apply the latest patches provided by Microsoft for their affected Windows versions.

Which versions of Windows are affected by CVE-2008-4037?

CVE-2008-4037 affects Windows 2000, XP, Server 2003, Vista, and Server 2008 across multiple service packs.

What type of attack does CVE-2008-4037 facilitate?

CVE-2008-4037 allows remote SMB servers to execute arbitrary code by replaying NTLM credentials.

Is CVE-2008-4037 being actively exploited?

Yes, CVE-2008-4037 has seen active exploitation in the wild due to its critical nature.