CVE-2008-4036 Integer overflow in n/a

What is CVE-2008-4036?

CVE-2008-4036 is a high-severity vulnerability in Microsoft Windows Server 2003, published on 15 Oct 2008. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Integer overflow in Memory Manager in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows local users to gain privileges via a crafted application that triggers an erroneous decrement of a variable, related to validation of parameters for Virtual Address Descriptors (VADs) and a "memory allocation mapping error," aka "Virtual Address Descriptor Elevation of Privilege Vulnerability."

Weakness: CWE-189, CWE-190

Which versions are affected by CVE-2008-4036?

It affects 4 products.

Products include Microsoft Windows Server 2003, Microsoft Windows Server 2008, Microsoft Windows Vista, Microsoft Windows Xp.

How do I fix CVE-2008-4036?

No fix has been published for CVE-2008-4036 yet. Limit exposure of the affected software until one is available.

Is CVE-2008-4036 being exploited?

There is no known exploitation of CVE-2008-4036 in the wild and no public exploit code.

Other vulnerabilities in Microsoft Windows Server 2003

• CVE-2011-2005 Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Exploited High 7.8
• CVE-2013-3863 Memory corruption in n/a Critical 9.3
• CVE-2013-3181 Memory corruption in n/a Critical 9.3
• CVE-2013-0077 Code injection in n/a Critical 9.3
• CVE-2012-0009 Path traversal in n/a Critical 9.3

All Microsoft Windows Server 2003 vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w7r5-8qrv-2w63.