Unscored severity · published Jun 12, 2008
CVE-2008-1440
Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets, which allows remote…
–
CVSS
22.6%
EPSS
No
On KEV
Description
Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted PGM packet, aka the "PGM Invalid Length Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)22.6% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Windows Server 2003 · Microsoft
All versions, or not specified · source: NVD
WX
Windows XP · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1440
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1440
Broken Link
http://secunia.com/advisories/30587
Broken Link
http://securitytracker.com/id?1020230
Broken Link
http://www.securityfocus.com/bid/29508
Broken Link
http://www.us-cert.gov/cas/techalerts/TA08-162B.html
Broken Link
http://www.vupen.com/english/advisories/2008/1783
Patch
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-036
More from Windows Server 2003
9.8
CVE-2008-4250
Microsoft Windows Buffer Overflow Vulnerability
8.8
CVE-2015-2360
Microsoft Win32k Privilege Escalation Vulnerability
8.8
CVE-2014-6324
Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability
8.8
CVE-2014-6332
Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability
8.8
CVE-2014-4148
Microsoft Windows Remote Code Execution Vulnerability