CVEvulnerability

CVE-2008-1440

7.1 HIGH Published 2008-06-12 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2008-06-12
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 7.1 HIGH — AV:N/AC:M/Au:N/C:N/I:N/A:C
Weaknesses: CWE-1284

Description

Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted PGM packet, aka the "PGM Invalid Length Vulnerability."

Affected configurations

• microsoft windows server 2003 • microsoft windows xp

Weakness · CWE (1)

CWE-1284 Improper Validation of Specified Quantity in Input weakness

Referenced by CWE · observed example (2)

CWE-1284 Improper Validation of Specified Quantity in Input weakness
CWE-20 Improper Input Validation weakness

References

http://secunia.com/advisories/30587 Broken Link, Permissions Required, Vendor Advisory
http://securitytracker.com/id?1020230 Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/29508 Broken Link, Patch, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-162B.html Broken Link, Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/1783 Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-036 Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5473 Broken Link
http://secunia.com/advisories/30587 Broken Link, Permissions Required, Vendor Advisory
http://securitytracker.com/id?1020230 Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/29508 Broken Link, Patch, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-162B.html Broken Link, Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/1783 Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-036 Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5473 Broken Link