CVE-2008-1084

Microsoft Windows - RCE

Title source: llm

Description

Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, through Vista SP1, and Server 2008 allows local users to execute arbitrary code via unknown vectors related to improper input validation. NOTE: it was later reported that one affected function is NtUserFnOUTSTRING in win32k.sys.

Exploits (2)

exploitdb SUSPICIOUS VERIFIED

by Ruben Santamarta · textlocalwindows

https://www.exploit-db.com/exploits/5518

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by Whitecell · cdoswindows

https://www.exploit-db.com/exploits/31585

View Code ZIP pw:eip

References (10)

[Mailing List] http://marc.info/?l=bugtraq&m=120845064910729&w=2

[Various Sources] http://milw0rm.com/sploits/2008-ms08-25-exploit.zip

[Vendor Advisory] http://secunia.com/advisories/29720

[Exploit, Patch] http://www.securityfocus.com/bid/28554

[US Government Resource] http://www.us-cert.gov/cas/techalerts/TA08-099A.html

[Vendor Advisory] http://www.vupen.com/english/advisories/2008/1149/references

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-025

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5437

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/5518

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1019803

Scores

EPSS 0.1043

EPSS Percentile 93.2%

Details

CWE

CWE-94

Status published

Products (5)

microsoft/windows_2000

microsoft/windows_2003_server (6 CPE variants)

microsoft/windows_server_2008

microsoft/windows_vista (2 CPE variants)

microsoft/windows_xp (3 CPE variants)

Published Apr 08, 2008

Tracked Since Feb 18, 2026