CVE-2008-3009

EPSS 52.28%
Veröffentlicht 10.12.2008 14:00:00
Zuletzt bearbeitet 09.04.2025 00:30:58
Quelle secure@microsoft.com
Teams Watchlist Login
Unerledigt Login

Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 11

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Microsoft ≫ Windows Media Player Version6.4

   Microsoft ≫ Windows 2000 Updatesp4
   Microsoft ≫ Windows Server 2003
   Microsoft ≫ Windows Server 2003 Updatesp1
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Xp Editionpro_x64
   Microsoft ≫ Windows Xp Updatesp2
   Microsoft ≫ Windows Xp Updatesp2 Editionpro_x64
   Microsoft ≫ Windows Xp Updatesp3

Microsoft ≫ Windows Media Format Runtime Version7.1

Microsoft ≫ Windows 2000 Updatesp4

Microsoft ≫ Windows Media Services Version4.1

Microsoft ≫ Windows 2000 Updatesp4

Microsoft ≫ Windows Media Services Version9

   Microsoft ≫ Windows Server 2003
   Microsoft ≫ Windows Server 2003 Updatesp1
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Xp Updatesp3

Microsoft ≫ Windows Media Services Version2008

Microsoft ≫ Windows Server 2008 Editionx32
Microsoft ≫ Windows Server 2008 Editionx64

Microsoft ≫ Windows Media Format Runtime Version11

   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Vista Editionx64
   Microsoft ≫ Windows Vista Updatesp1
   Microsoft ≫ Windows Vista Versiongold
   Microsoft ≫ Windows Xp Editionx64
   Microsoft ≫ Windows Xp Updatesp2
   Microsoft ≫ Windows Xp Updatesp2 Editionpro_x64
   Microsoft ≫ Windows Xp Updatesp3

Microsoft ≫ Windows Media Format Runtime Version11 Editionx64

   Microsoft ≫ Windows Server 2003
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Xp Editionpro_x64
   Microsoft ≫ Windows Xp Updatesp2 Editionpro_x64

Microsoft ≫ Windows Media Format Runtime Version9.5 Editionx64

   Microsoft ≫ Windows Server 2003
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Xp Editionx64
   Microsoft ≫ Windows Xp Updatesp2 Editionpro_x64

Microsoft ≫ Windows Media Format Runtime Version9.5

   Microsoft ≫ Windows Server 2003
   Microsoft ≫ Windows Server 2003 Updatesp1
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Xp Editionx64
   Microsoft ≫ Windows Xp Updatesp2
   Microsoft ≫ Windows Xp Updatesp2 Editionpro_x64
   Microsoft ≫ Windows Xp Updatesp3

Microsoft ≫ Windows Media Format Runtime Version9

   Microsoft ≫ Windows 2000 Updatesp4
   Microsoft ≫ Windows Xp Updatesp2
   Microsoft ≫ Windows Xp Updatesp3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	52.28%	0.978

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

http://www.us-cert.gov/cas/techalerts/TA08-344A.html

US Government Resource

http://secunia.com/advisories/33058

http://www.securityfocus.com/bid/32653

http://www.securitytracker.com/id?1021372

http://www.securitytracker.com/id?1021373

http://www.vupen.com/english/advisories/2008/3388

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-076

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5942

https://nvd.nist.gov/vuln/detail/CVE-2008-3009

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2008-3009

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2008-3009

EUVD