CVE-2008-2246 Security feature bypass in n/a
Remote attackers can bypass IPsec access restrictions due to improper policy import from Windows Server 2003 to 2008 domains.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-2246?
CVE-2008-2246 is a high-severity vulnerability in Microsoft Windows Vista, published on 13 Aug 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Microsoft Windows Vista through SP1 and Server 2008 do not properly import the default IPsec policy from a Windows Server 2003 domain to a Windows Server 2008 domain, which prevents IPsec rules from being enforced and allows remote attackers to bypass intended access restrictions.
Weakness: CWE-200
Which versions are affected by CVE-2008-2246?
It affects 2 products.
Products include Microsoft Windows-Nt, Microsoft Windows Vista.
How do I fix CVE-2008-2246?
No fix has been published for CVE-2008-2246 yet. Limit exposure of the affected software until one is available.
Is CVE-2008-2246 being exploited?
There is no known exploitation of CVE-2008-2246 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Windows Vista
Sources
Also known as GHSA-gr59-3xq7-cc69.