Very High
Microsoft RPC Code Execution MS08-067
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
Very High
(2 users assessed)
Very High
(2 users assessed)Unknown
Unknown
Unknown
Microsoft RPC Code Execution MS08-067
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka “Server Service Vulnerability.”
Add Assessment
Ratings
-
Attacker ValueVery High
-
ExploitabilityVery High
Technical Analysis
A classic vulnerability. Like small pox, you’d wish it was actually eradicated by now, but it still pops up occasionally in legacy systems.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild Report
Ratings
-
Attacker ValueVery High
-
ExploitabilityVery High
Technical Analysis
MS08-067 was possibly the most popular vulnerability of the 2000s. It allows remote code execution, pre-authentication, against all default Windows operating system configurations of the time. While SMB, should never be exposed on the Internet, once on the internal network, almost all windows systems have it enabled.
Exploitation is trivial (point and shoot) through metasploit: https://www.rapid7.com/db/modules/exploit/windows/smb/ms08_067_netapi
This exploit was widely used and most notably known for the Conficker worm: https://en.wikipedia.org/wiki/Conficker
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportGeneral Information
References
Miscellaneous
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Definitely still do see this vulnerability around in small businesses, tho most organisations have patches for their legacy systems some are unaware of how critical this vulnerability actually is.