>> Microsoft Host Integration Server Code Execution Vulnerability (MS08-059)
Title : Microsoft Host Integration Server Code Execution Vulnerability (MS08-059) VUPEN ID : VUPEN/ADV-2008-2810 CVE ID : CVE-2008-3466 CWE ID : CWE-287
Rated as : Critical
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2008-10-14
A vulnerability has been identified in Microsoft Host Integration Server, which could be exploited by remote attackers to take complete control of an affected system. This issue is caused by an error in the SNA Remote Procedure Call (RPC) service that exposes several methods e.g. RPC opcodes 1 and 6 allow calls the "CreateProcess()" function, which could allow remote unauthenticated attackers to execute arbitrary commands via a specially crafted RPC message.
