CVE-2008-3010 Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1 and 9 incorrectly associate ISATAP addresses with the Local Intranet zone, which allows....
HighCVSS 10.0
EPSS 15.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1 and 9 incorrectly associate ISATAP addresses with the Local Intranet zone, which allows remote servers to capture NTLM credentials, and execute arbitrary code through credential-reflection attacks, by sending an authentication request, aka "ISATAP Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows media player | = 6.4 | No fix listed |
References
- 33058 third-party-advisory
- 32654 vdb-entry
- 1021374 vdb-entry
- 1021375 vdb-entry
- TA08-344A third-party-advisory us-government-resource
- ADV-2008-3388 vdb-entry
- MS08-076 vendor-advisory
- oval:org.mitre.oval:def:5689 signature vdb-entry