CVE-2008-1440

HighCVSS 7.1/10Last modified Jun 16, 2026

Description

Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted PGM packet, aka the "PGM Invalid Length Vulnerability."

Metrics

CVSS 2.0 7.1/10AV:N/AC:M/Au:N/C:N/I:N/A:C

Weakness enumeration

CWE-1284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/30587Broken Link, Permissions Required, Vendor Advisory
http://securitytracker.com/id?1020230Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/29508Broken Link, Patch, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-162B.htmlBroken Link, Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/1783Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-036Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5473Broken Link
http://secunia.com/advisories/30587Broken Link, Permissions Required, Vendor Advisory
http://securitytracker.com/id?1020230Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/29508Broken Link, Patch, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-162B.htmlBroken Link, Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/1783Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-036Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5473Broken Link

Timeline

Published: Jun 12, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-14415.4Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of CVE-2008-14429.3Heap-based buffer overflow in the substringData method in Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary c CVE-2008-14449.3Stack-based buffer overflow in Microsoft DirectX 7.0 and 8.1 on Windows 2000 SP4 allows remote attackers to execute arbitrary code via a Syn CVE-2008-14457.1Active Directory on Microsoft Windows 2000 Server SP4, XP Professional SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote a CVE-2008-14469.0Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on CVE-2008-14476.8The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 CVE-2008-14487.1The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the corr CVE-2008-14517.2The WINS service on Microsoft Windows 2000 SP4, and Server 2003 SP1 and SP2, does not properly validate data structures in WINS network pack CVE-2008-14538.3The Bluetooth stack in Microsoft Windows XP SP2 and SP3, and Vista Gold and SP1, allows physically proximate attackers to execute arbitrary CVE-2008-14549.4Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct CVE-2008-14556.8A "memory calculation error" in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP2, and 2007 through SP1; Office Compatibility Pack fo CVE-2008-14569.0Array index vulnerability in the Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, an