Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2008-3464

Overview

Vulnerability Score 7.2 7.2
CVE Id CVE-2008-3464
Last Modified 07 Mar 2011 10:10:51
Published 14 Oct 2008 08:12:15
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector LOCAL
Access Complexity LOW
Authentication NONE

CVE-2008-3464

Summary

afd.sys in the Ancillary Function Driver (AFD) component in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP1 and SP2 does not properly validate input sent from user mode to the kernel, which allows local users to gain privileges via a crafted application, as demonstrated using crafted pointers and lengths that bypass intended ProbeForRead and ProbeForWrite restrictions, aka "AFD Kernel Overwrite Vulnerability."

Vulnerable Systems

Operating System

  • Microsoft Windows 2003 Server

  • Microsoft Windows 2003 Server Professional

  • Microsoft Windows Xp


References

CERT - TA08-288A

BID - 31673

MS - MS08-066

SECUNIA - 32261

XF - win-ms08kb956803-update(45582)

XF - win-afd-privilege-escalation(45578)

VUPEN - ADV-2008-2817

SECTRACK - 1021053

BUGTRAQ - 20081015 Exploit for MS08-066 - AFD.sys kernel memory overwrite.

MILW0RM - 6757

HP - SSRT080143

MISC - http://blogs.technet.com/swi/archive/2008/10/14/ms08-066-how-to-correctly-validate-and-capture-user-mode-data.aspx

HP - HPSBST02379


Last Updated: 27 May 2016 10:49:56