CVE-2008-0951

Microsoft Windows Vista - Arbitrary Code Execution via Autorun.inf Handling

Title source: llm

Description

Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value, which allows user-assisted remote attackers, and possibly physically proximate attackers, to execute arbitrary code by inserting a (1) CD-ROM device or (2) U3-enabled USB device containing a filesystem with an Autorun.inf file, and possibly other vectors related to (a) AutoRun and (b) AutoPlay actions.

References (7)

Core 7

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/41349

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/28360

US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/889747

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1020446

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-038

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/0954/references

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/29458

Scores

EPSS 0.3011

EPSS Percentile 98.0%

Details

CWE

CWE-94

Status published

Products (1)

microsoft/windows_vista (5 CPE variants)

Published Mar 24, 2008

Tracked Since Feb 18, 2026