CVE-2008-4114

srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via an SMB WRITE_ANDX packet with an offset that is inconsistent with the packet size, related to "insufficiently validating the buffer size," as demonstrated by a request to the \PIPE\lsarpc named pipe, aka "SMB Validation Denial of Service Vulnerability."

• CWE-399

• http://secunia.com/advisories/31883Vendor Advisory
• http://www.reversemode.com/index.php?option=com_content&task=view&id=54&Itemid=1Exploit
• http://www.securityfocus.com/archive/1/496354/100/0/threaded
• http://www.securityfocus.com/bid/31179Exploit
• http://www.securitytracker.com/id?1020887
• http://www.us-cert.gov/cas/techalerts/TA09-013A.htmlUS Government Resource
• http://www.vallejo.cc/proyectos/vista_SMB_write_DoS.htmExploit
• http://www.vupen.com/english/advisories/2008/2583Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-001
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45146
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5262
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6044
• https://www.exploit-db.com/exploits/6463
• http://secunia.com/advisories/31883Vendor Advisory
• http://www.reversemode.com/index.php?option=com_content&task=view&id=54&Itemid=1Exploit
• http://www.securityfocus.com/archive/1/496354/100/0/threaded
• http://www.securityfocus.com/bid/31179Exploit
• http://www.securitytracker.com/id?1020887
• http://www.us-cert.gov/cas/techalerts/TA09-013A.htmlUS Government Resource
• http://www.vallejo.cc/proyectos/vista_SMB_write_DoS.htmExploit
• http://www.vupen.com/english/advisories/2008/2583Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-001
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45146
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5262
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6044
• https://www.exploit-db.com/exploits/6463

Published

Sep 16, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-4108Tools/faqwiz/move-faqwiz.sh (aka the generic FAQ wizard movi…
• CVE-2008-4109A certain Debian patch for OpenSSH before 4.3p2-9etch3 on et…
• CVE-2008-4110Buffer overflow in the SQLVDIRLib.SQLVDirControl ActiveX con…
• CVE-2008-4111Unspecified vulnerability in Servlet Engine/Web Container in…
• CVE-2008-4112Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2008-4113The sctp_getsockopt_hmac_ident function in net/sctp/socket.c…
• CVE-2008-4115TalkBack 2.3.6 allows remote attackers to obtain configurati…
• CVE-2008-4116Buffer overflow in Apple QuickTime 7.5.5 and iTunes 8.0 allo…
• CVE-2008-4117Unspecified vulnerability in a web page in the PRM module in…
• CVE-2008-4118Cross-site scripting (XSS) vulnerability in High Norm Sound …
• CVE-2008-4119Multiple cross-site scripting (XSS) vulnerabilities in CA Se…
• CVE-2008-4120Multiple cross-site scripting (XSS) vulnerabilities in FlatP…