CVE-2008-2547
Published Jun 4, 2008
Last updated 6 years ago
Overview
- Description
- Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows Installer allows context-dependent attackers to execute arbitrary code via a long GUID value for the /x (aka /uninstall) option. NOTE: this issue might cross privilege boundaries if msiexec.exe is reachable via components such as ActiveX controls, and might additionally require a separate vulnerability in the control.
- Source
- cve@mitre.org
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 9.3
- Impact score
- 10
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
- nvd@nist.gov
- CWE-119
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:windows_installer:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6231D8EA-667C-4F22-837B-F774D1EAC61F"
},
{
"criteria": "cpe:2.3:a:microsoft:windows_installer:3.1.4000.1823:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "437990EF-269B-44AA-82EF-C4D2980844F9"
},
{
"criteria": "cpe:2.3:a:microsoft:windows_installer:4.5.6001.22159:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D326779-EB10-4911-B6D3-5D8C4BD11C37"
}
],
"operator": "OR"
}
]
}
]