Vulnerability Details : CVE-2008-4036
Integer overflow in Memory Manager in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows local users to gain privileges via a crafted application that triggers an erroneous decrement of a variable, related to validation of parameters for Virtual Address Descriptors (VADs) and a "memory allocation mapping error," aka "Virtual Address Descriptor Elevation of Privilege Vulnerability."
Vulnerability category: OverflowGain privilege
Products affected by CVE-2008-4036
- cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:x64:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2003:*:sp1:x64:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2003:*:sp1:itanium:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_vista:sp1:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2008-4036
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 26 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-4036
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
8.4
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.5
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2024-10-15 |
CWE ids for CVE-2008-4036
-
Assigned by: nvd@nist.gov (Primary)
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
References for CVE-2008-4036
-
http://marc.info/?l=bugtraq&m=122479227205998&w=2
'[security bulletin] HPSBST02379 SSRT080143 rev.1 - Storage Management Appliance (SMA), Microsoft Pat' - MARC
-
http://www.vupen.com/english/advisories/2008/2815
Webmail: access your OVH emails on ovhcloud.com | OVHcloud
-
http://secunia.com/advisories/32251
About Secunia Research | FlexeraPatch;Vendor Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5343
404 Not Found
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/45571
Microsoft Windows Memory Manager Virtual Address Descriptors privilege escalation CVE-2008-4036 Vulnerability Report
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/45572
Microsoft Windows Knowledge Base Article 9556841 update is not installed CVE-2008-4036 Vulnerability Report
-
http://www.securityfocus.com/bid/31675
Patch
-
http://www.us-cert.gov/cas/techalerts/TA08-288A.html
Page Not Found | CISAUS Government Resource
-
http://www.securitytracker.com/id?1021051
GoDaddy Domain Name Search
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-064
Microsoft Security Bulletin MS08-064 - Important | Microsoft Learn
Jump to