CVE-2008-4301 Other in n/a
A disputed vulnerability in an IIS ActiveX control allegedly allowed remote password setting, but the issue is considered erroneous and unreproducible.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2008-4301?
CVE-2008-4301 is a critical vulnerability in Microsoft Internet Information Services, published on 29 Sep 2008. It can be exploited over the network, and only if a user opens a file or follows a link.
Official description
A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a string argument to the SetPassword method. NOTE: this issue could not be reproduced by a reliable third party. In addition, the original researcher is unreliable. Therefore the original disclosure is probably erroneous
Which versions are affected by CVE-2008-4301?
It affects 1 product.
Products include Microsoft Internet Information Services.
How do I fix CVE-2008-4301?
No fix has been published for CVE-2008-4301 yet. Limit exposure of the affected software until one is available.
Is CVE-2008-4301 being exploited?
There is no known exploitation of CVE-2008-4301 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Internet Information Services
- CVE-2017-7269 Microsoft Windows Server Buffer Overflow
- CVE-2010-3972 Memory corruption in n/a
- CVE-2007-2815 The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL
- CVE-2003-0224 Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web pa
- CVE-1999-0233 IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files.
Sources
Also known as GHSA-6x8c-j743-7x28.