What’s Vulnerable › Vulnerabilities

CVE-2008-3466

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 77.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2008-10-15 · updated 2026-06-16
• Weakness: CWE-287

Description

Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS Command Execution Vulnerability."

Affected products

• Microsoft Host Integration Server 2000: all versions
• Microsoft Host Integration Server 2004: all versions
• Microsoft Host Integration Server 2006: all versions

References

• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745
• http://marc.info/?l=bugtraq&m=122479227205998&w=2
• http://secunia.com/advisories/32233
• http://www.securityfocus.com/bid/31620
• http://www.securitytracker.com/id?1021043
• http://www.us-cert.gov/cas/techalerts/TA08-288A.html
• http://www.vupen.com/english/advisories/2008/2810
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-059
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6075
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745
• http://marc.info/?l=bugtraq&m=122479227205998&w=2
• http://secunia.com/advisories/32233

Get alerted when CVE-2008-3466 or the next vulnerability affects your stack