CVE-2008-3068 Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate...
HighCVSS 7.5
EPSS 17.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft access | = 2007 | No fix listed |
| Microsoft excel | = 2003 | No fix listed |
| Microsoft excel | = 2007 | No fix listed |
| Microsoft frontpage | = 2003 | No fix listed |
| Microsoft groove | = 2007 | No fix listed |
| Microsoft infopath | = 2003 | No fix listed |
| Microsoft infopath | = 2007 | No fix listed |
| Microsoft office | = 2007 | No fix listed |
| Microsoft office | = 2007-sp1 | No fix listed |
| Microsoft office communicator | = 2007 | No fix listed |
| Microsoft onenote | = 2003 | No fix listed |
| Microsoft outlook | = 2003 | No fix listed |
| Microsoft outlook | = 2007 | No fix listed |
| Microsoft powerpoint | = 2003 | No fix listed |
| Microsoft powerpoint | = 2007 | No fix listed |
| Microsoft project professional | = 2007 | No fix listed |
| Microsoft project standard | = 2007 | No fix listed |
| Microsoft publisher | = 2003 | No fix listed |
| Microsoft publisher | = 2007 | No fix listed |
| Microsoft sharepoint designer | = 2007 | No fix listed |
| Microsoft visio professional | = 2007 | No fix listed |
| Microsoft visio standard | = 2007 | No fix listed |
| Microsoft windows live mail | = 2008 | No fix listed |
References
- 3978 third-party-advisory
- 20080703 Unauthorized reading confirmation from Outlook mailing-list
- 20080709 Re: Unauthorized reading confirmation from Outlook mailing-list
- 28548 vdb-entry
- 1019736 vdb-entry
- 1019737 vdb-entry
- 1019738 vdb-entry
- www.cynops.de
- www.cynops.de
- www.cynops.de
- www.cynops.de
- www.klink.name
- www.klink.name
- www.klink.name