Vulnerability Name:

CVE-2008-1437 (CCN-42107)

Assigned:2008-05-13
Published:2008-05-13
Updated:2018-10-12
Summary:Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (engine hang and restart) via a crafted file, a different vulnerability than CVE-2008-1438.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-399
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2008-1437

Source: CCN
Type: HP Security Bulletin HPSBST02336 SSRT080071 rev.1
Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-026 to MS08-029

Source: HP
Type: UNKNOWN
SSRT080071

Source: CCN
Type: SA30172
Microsoft Malware Protection Engine File Parsing Denial of Service

Source: SECUNIA
Type: Vendor Advisory
30172

Source: CCN
Type: SECTRACK ID: 1020016
Microsoft Malware Protection Engine Lets Remote Users Deny Service

Source: CCN
Type: ASA-2008-210
MS08-029 Vulnerabilities in Microsoft Malware Protection Engine Could Allow Denial of Service (952044)

Source: CCN
Type: Microsoft Security Bulletin MS08-029
Vulnerabilities in Microsoft Malware Protection Engine Could Allow Denial of Service (952044)

Source: BID
Type: UNKNOWN
29060

Source: CCN
Type: BID-29060
Microsoft Malware Protection Engine File Processing Remote Denial Of Service Vulnerability

Source: SECTRACK
Type: UNKNOWN
1020016

Source: CERT
Type: US Government Resource
TA08-134A

Source: VUPEN
Type: UNKNOWN
ADV-2008-1506

Source: MS
Type: UNKNOWN
MS08-029

Source: XF
Type: UNKNOWN
malwareprotectionengine-file-dos(42107)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:13981

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:antigen_for_exchange:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:antigen_for_smtp_gateway:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:diagnostics_and_recovery_toolkit:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:forefront_client_security:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:forefront_security_for_exchange_server:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:forefront_security_for_sharepoint:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:malware_protection_engine:0.1.13.192:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:malware_protection_engine:1.1.3520.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:windows_defender:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:windows_live_onecare:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:antigen_for_exchange:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:windows_defender:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:antigen_for_smtp_gateway:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:windows_live_onecare:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:forefront_client_security:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:forefront_security_for_exchange_server:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:forefront_security_for_sharepoint:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:13981
    V
    		Microsoft Malware Protection Engine Vulnerability-I
    2012-01-16
    BACK
    microsoft antigen for exchange *
    microsoft antigen for smtp gateway *
    microsoft diagnostics and recovery toolkit 6.0
    microsoft forefront client security *
    microsoft forefront security for exchange server *
    microsoft forefront security for sharepoint *
    microsoft malware protection engine 0.1.13.192
    microsoft malware protection engine 1.1.3520.0
    microsoft windows defender *
    microsoft windows live onecare *
    microsoft antigen for exchange *
    microsoft windows defender *
    microsoft antigen for smtp gateway *
    microsoft windows live onecare *
    microsoft forefront client security *
    microsoft forefront security for exchange server *
    microsoft forefront security for sharepoint *