CVE-2008-4114

Summary

CVE	CVE-2008-4114
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2008-09-16 23:00:01 UTC
Updated	2026-04-23 00:35:47 UTC
Description	srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via an SMB WRITE_ANDX packet with an offset that is inconsistent with the packet size, related to "insufficiently validating the buffer size," as demonstrated by a request to the \PIPE\lsarpc named pipe, aka "SMB Validation Denial of Service Vulnerability."

Risk And Classification

Primary CVSS: v2.0 7.1 from [email protected]

AV:N/AC:M/Au:N/C:N/I:N/A:C

Problem Types: CWE-399 | n/a

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

AV:N/AC:M/Au:N/C:N/I:N/A:C

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Microsoft	Windows 2000	All	sp4	All	All
Operating System	Microsoft	Windows Server 2003	All	All	All	All
Operating System	Microsoft	Windows Server 2003	All	sp1	All	All
Operating System	Microsoft	Windows Server 2003	All	sp1	itanium	All
Operating System	Microsoft	Windows Server 2003	All	sp2	All	All
Operating System	Microsoft	Windows Server 2008	All	All	itanium	All
Operating System	Microsoft	Windows Server 2008	All	All	x32	All
Operating System	Microsoft	Windows Server 2008	All	All	x64	All
Operating System	Microsoft	Windows Vista	All	gold	x64	All
Operating System	Microsoft	Windows Vista	All	sp1	All	All
Operating System	Microsoft	Windows Vista	gold	All	All	All
Operating System	Microsoft	Windows Vista	sp1	All	All	All
Operating System	Microsoft	Windows Xp	All	All	pro_x64	All
Operating System	Microsoft	Windows Xp	All	sp2	All	All
Operating System	Microsoft	Windows Xp	All	sp2	pro_x64	All
Operating System	Microsoft	Windows Xp	All	sp3	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

References

Reference	Source	Link	Tags
Repository / Oval Repository	af854a3a-2127-422b-91ae-364da2661108	oval.cisecurity.org
401 Unauthorized	af854a3a-2127-422b-91ae-364da2661108	www.reversemode.com	Exploit
Microsoft Security Bulletin MS09-001 - Critical \| Microsoft Docs	af854a3a-2127-422b-91ae-364da2661108	docs.microsoft.com
Microsoft Windows SMB Packet Handling Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Vendor Advisory
IBM X-Force Exchange	af854a3a-2127-422b-91ae-364da2661108	exchange.xforce.ibmcloud.com
Webmail : Solution de messagerie professionnelle - OVHcloud- OVH	af854a3a-2127-422b-91ae-364da2661108	www.vupen.com	Vendor Advisory
Repository / Oval Repository	af854a3a-2127-422b-91ae-364da2661108	oval.cisecurity.org
Vallejo.9090909090CC	af854a3a-2127-422b-91ae-364da2661108	www.vallejo.cc	Exploit
Windows SMB Processing Bug Lets Remote Users Deny Service - SecurityTracker	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com
US-CERT Technical Cyber Security Alert TA09-013A -- Microsoft Updates for Multiple SMB Protocol Vulnerabilities	af854a3a-2127-422b-91ae-364da2661108	www.us-cert.gov	US Government Resource
SecurityFocus	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
MS Windows WRITE_ANDX SMB command handling Kernel DoS (meta)	af854a3a-2127-422b-91ae-364da2661108	www.exploit-db.com
Microsoft Windows WRITE_ANDX SMB Processing Remote Denial Of Service Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Exploit
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.