CVE-2008-0951 - Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value, which allows user-assisted remote attackers, and possibly physically proximate attackers, to execute arbitrary code by inserting a (1) CD-ROM device or (2) U3-enabled USB device containing a filesystem with an Autorun.inf file, and possibly other vectors related to (a) AutoRun and (b) AutoPlay actions

Back Back to CVE browser

HIGH

Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value, which allows user-assisted remote attackers, and possibly physically proximate attackers, to execute arbitrary code by inserting a (1) CD-ROM device or (2) U3-enabled USB device containing a filesystem with an Autorun.inf file, and possibly other vectors related to (a) AutoRun and (b) AutoPlay actions

Published Mar 24, 2008

9.3

HIGH

CVSS 2.0

EPSS 30.11%

Description

Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value, which allows user-assisted remote attackers, and possibly physically proximate attackers, to execute arbitrary code by inserting a (1) CD-ROM device or (2) U3-enabled USB device containing a filesystem with an Autorun.inf file, and possibly other vectors related to (a) AutoRun and (b) AutoPlay actions.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (8)

http://secunia.com/advisories/29458
third-party-advisoryx_refsource_SECUNIA
http://www.kb.cert.org/vuls/id/889747
third-party-advisoryx_refsource_CERT-VNUS Government Resource
http://www.securityfocus.com/bid/28360
vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1020446
vdb-entryx_refsource_SECTRACK
http://www.vupen.com/english/advisories/2008/0954/references
vdb-entryx_refsource_VUPEN
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-038
vendor-advisoryx_refsource_MS
https://euvd.enisa.europa.eu/vulnerability/EUVD-2008-0958
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41349
vdb-entryx_refsource_XF

Link	Providers	Tags
http://secunia.com/advisories/29458		third-party-advisoryx_refsource_SECUNIA
http://www.kb.cert.org/vuls/id/889747		third-party-advisoryx_refsource_CERT-VNUS Government Resource
http://www.securityfocus.com/bid/28360		vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1020446		vdb-entryx_refsource_SECTRACK
http://www.vupen.com/english/advisories/2008/0954/references		vdb-entryx_refsource_VUPEN
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-038		vendor-advisoryx_refsource_MS
https://euvd.enisa.europa.eu/vulnerability/EUVD-2008-0958		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41349		vdb-entryx_refsource_XF