CVE-2008-4037 Auth bypass in n/a

Critical 9.3 Published 12 Nov 2008 Updated 7 Aug 2024

Remote SMB servers can execute arbitrary code on client machines by replaying NTLM credentials, requiring user interaction to connect to a malicious server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2008-4037?

CVE-2008-4037 is a critical authentication bypass vulnerability in Microsoft Windows, published on 12 Nov 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka "SMB Credential Reflection Vulnerability." NOTE: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834.

Weakness: CWE-287

Which versions are affected by CVE-2008-4037?

It affects 4 products.

Products include Microsoft Windows, Microsoft Windows 2000, Microsoft Windows Server 2008, Microsoft Windows Vista.

How do I fix CVE-2008-4037?

No fix has been published for CVE-2008-4037 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2008-4037 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-4037 exists.

Public exploit code: 1 Metasploit module and 3 Exploit-DB entries.

All Microsoft Windows vulnerabilities

Sources

Also known as GHSA-g42p-2gq8-x2p3.