Vulnerability Name:

CVE-2008-4037 (CCN-46191)

Assigned:2008-11-11
Published:2008-11-11
Updated:2018-10-30
Summary:Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka "SMB Credential Reflection Vulnerability."
Note: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.7 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.7 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-287
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-4037

Source: CCN
Type: HP Security Bulletin HPSBST02394 SSRT080183 rev.1
Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-070 to MS08-077

Source: HP
Type: UNKNOWN
SSRT080164

Source: OSVDB
Type: UNKNOWN
49736

Source: CCN
Type: SA32633
Microsoft Windows SMB Authentication Credential Replay Vulnerability

Source: SECUNIA
Type: Vendor Advisory
32633

Source: CCN
Type: SECTRACK ID: 1021163
Windows Server Message Block NTLM Authentication Replay Bug Lets Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1021163

Source: CCN
Type: ASA-2008-437
MS08-068 Vulnerability in SMB Could Allow Remote Code Execution (957097)

Source: CCN
Type: Microsoft Security Bulletin MS08-068
Vulnerability in SMB Could Allow Remote Code Execution (957097)

Source: CCN
Type: Microsoft Security Bulletin MS10-006
Vulnerabilities in SMB Client Could Allow Remote Code Execution (978251)

Source: CCN
Type: Microsoft Security Bulletin MS10-020
Vulnerabilities in SMB Client Could Allow Remote Code Execution (980232)

Source: CCN
Type: Microsoft Security Bulletin MS11-019
Vulnerabilities in SMB Client Could Allow Remote Code Execution (2511455)

Source: CCN
Type: Microsoft Security Bulletin MS11-043
Vulnerability in SMB Client Could Allow Remote Code Execution (2536276)

Source: MISC
Type: UNKNOWN
http://www.networkworld.com/news/2008/111208-microsoft-seven-year-security-patch.html

Source: CCN
Type: OSVDB ID: 49736
Microsoft Windows SMB NTLM Authentication Credential Replay Remote Code Execution

Source: BID
Type: Exploit, Patch
7385

Source: CCN
Type: BID-7385
Microsoft Windows SMB Credential Reflection Vulnerability

Source: MISC
Type: Exploit
http://www.securityfocus.com/data/vulnerabilities/exploits/backrush.patch

Source: MISC
Type: Exploit
http://www.securityfocus.com/data/vulnerabilities/exploits/backrush.patch.README

Source: CERT
Type: US Government Resource
TA08-316A

Source: MISC
Type: UNKNOWN
http://www.veracode.com/blog/2008/11/microsoft-fixes-8-year-old-design-flaw-in-smb/

Source: VUPEN
Type: Vendor Advisory
ADV-2008-3110

Source: MISC
Type: UNKNOWN
http://www.xfocus.net/articles/200305/smbrelay.html

Source: MS
Type: UNKNOWN
MS08-068

Source: XF
Type: UNKNOWN
win-smb-ntlm-code-execution(46191)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:6012

Source: EXPLOIT-DB
Type: UNKNOWN
7125

Source: CCN
Type: Rapid7 Vulnerability and Exploit Database
MS08-068 Microsoft Windows SMB Relay Code Execution

Vulnerable Configuration:Configuration 1:
  • cpe:/o:microsoft:windows:server_2003:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp1:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:unknown:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:unknown:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_vista:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp1:x64:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server::x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:::x64:*:professional:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server:sp1_itanium:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:*:sp2:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:*:sp2:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows:server_2003:*:sp2:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_vista:::~~~~x64~:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp::sp2:x64:*:professional:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows:xp:sp3:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:6012
    V
    		SMB Credential Reflection Vulnerability
    2014-03-03
    BACK
    microsoft windows server_2003 sp1
    microsoft windows server_2003 sp1
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows server_2003 unknown
    microsoft windows xp sp2
    microsoft windows xp sp2
    microsoft windows xp sp3
    microsoft windows xp unknown
    microsoft windows 2000 - sp4
    microsoft windows server 2008 -
    microsoft windows server 2008 -
    microsoft windows server 2008 -
    microsoft windows vista -
    microsoft windows vista -
    microsoft windows vista - sp1
    microsoft windows vista - sp1
    microsoft windows 2000 sp4
    microsoft windows 2003_server
    microsoft windows xp sp2
    microsoft windows 2003_server sp1
    microsoft windows xp
    microsoft windows 2003_server sp1_itanium
    microsoft windows vista
    microsoft windows server_2003
    microsoft windows server_2003
    microsoft windows server_2003
    microsoft windows vista
    microsoft windows xp sp2
    microsoft windows vista sp1
    microsoft windows vista sp1
    microsoft windows server 2008
    microsoft windows server 2008 -
    microsoft windows server 2008 -
    microsoft windows xp sp3