MS08-067 was a vulnerability in Windows and affected every version of Windows available at that point.
Explicit Confidence 99% · John Lambert EP 57 Details
“it affected every version of Windows up until we had at that point”
Vulnerability
vulnerability:ms08_067
Microsoft security bulletin identifying a critical, remotely exploitable, wormable vulnerability affecting Windows.
Microsoft security bulletin identifying a critical, remotely exploitable, wormable vulnerability affecting Windows.
“the security bulletin MS08-067”
“this exploit was wormable”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | AFFECTS | Windows | Explicit | 57 |
| outgoing | AFFECTS | Windows XP | Explicit | 57 |
| outgoing | ASSOCIATED_WITH | Remote Code Execution | Explicit | 57 |
| outgoing | ASSOCIATED_WITH | wormable | Explicit | 57 |
| outgoing | DISCOVERED_BY | Andrew | Explicit | 57 |
| outgoing | DISCOVERED_BY | John Lambert | Explicit | 57 |
| incoming | EXPLOITS | MS08-067 | Explicit | 57 |
MS08-067 was a vulnerability in Windows and affected every version of Windows available at that point.
Explicit Confidence 99% · John Lambert EP 57 Details
“it affected every version of Windows up until we had at that point”
MS08-067 AFFECTS Windows XP
The vulnerability was found in Windows XP and was present in fully updated Windows systems.
Explicit Confidence 98% · Jack Rhysider EP 57 Details
“While they found this in Windows XP, the vulnerability existed in more than just XP”
The MS08-067 exploit was used to exploit the MS08-067 vulnerability.
Explicit Confidence 99% · Jack Rhysider EP 57 Details
“run this exploit against it”
MS08-067 ASSOCIATED_WITH Remote Code Execution
The vulnerability allowed remote code execution: an attacker could execute commands on the victim's Windows computer.
Explicit Confidence 98% · Jack Rhysider EP 57 Details
“In the security world we call this kind of vulnerability an RCE which means you can do Remote Code Execution”
MS08-067 ASSOCIATED_WITH wormable
The vulnerability was wormable, meaning an exploit could propagate across the internet and repeat the attack on additional systems.
Explicit Confidence 99% · John Lambert EP 57 Details
“Wormable means that you have a vulnerability that an attacker can write an exploit for and it can propagate across the internet”
Andrew identified the previously unknown vulnerability after analyzing the crash report and related code.
Explicit Confidence 98% · John Lambert EP 57 Details
“He said I found a vulnerability”
MS08-067 DISCOVERED_BY John Lambert
John Lambert identified evidence of a new attack and unknown vulnerability in Windows through Windows Error Reporting crash data.
Explicit Confidence 93% · John Lambert EP 57 Details
“I clearly had enough evidence to say this was a new attack, a new vulnerability that we did not know about”