FKIE_CVE-2008-3068

Vulnerability from fkie_nvd - Published: 2008-07-07 23:41 - Updated: 2025-04-09 00:30
Severity ?
Summary
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
References
cve@mitre.orghttp://securityreason.com/securityalert/3978
cve@mitre.orghttp://www.securityfocus.com/archive/1/493947/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/archive/1/494101/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/28548
cve@mitre.orghttp://www.securitytracker.com/id?1019736
cve@mitre.orghttp://www.securitytracker.com/id?1019737
cve@mitre.orghttp://www.securitytracker.com/id?1019738
cve@mitre.orghttps://www.cynops.de/advisories/AKLINK-SA-2008-002.txt
cve@mitre.orghttps://www.cynops.de/advisories/AKLINK-SA-2008-003.txt
cve@mitre.orghttps://www.cynops.de/advisories/AKLINK-SA-2008-004.txt
cve@mitre.orghttps://www.cynops.de/techzone/http_over_x509.html
cve@mitre.orghttps://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt
cve@mitre.orghttps://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt
cve@mitre.orghttps://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/3978
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/493947/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/494101/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/28548
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1019736
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1019737
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1019738
af854a3a-2127-422b-91ae-364da2661108https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt
af854a3a-2127-422b-91ae-364da2661108https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt
af854a3a-2127-422b-91ae-364da2661108https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt
af854a3a-2127-422b-91ae-364da2661108https://www.cynops.de/techzone/http_over_x509.html
af854a3a-2127-422b-91ae-364da2661108https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt
af854a3a-2127-422b-91ae-364da2661108https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt
af854a3a-2127-422b-91ae-364da2661108https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt
Impacted products
Vendor Product Version
microsoft access 2007
microsoft excel 2003
microsoft excel 2007
microsoft frontpage 2003
microsoft groove 2007
microsoft infopath 2003
microsoft infopath 2007
microsoft office 2007
microsoft office 2007
microsoft office_communicator 2007
microsoft onenote 2003
microsoft outlook 2003
microsoft outlook 2007
microsoft powerpoint 2003
microsoft powerpoint 2007
microsoft project_professional 2007
microsoft project_standard 2007
microsoft publisher 2003
microsoft publisher 2007
microsoft sharepoint_designer 2007
microsoft visio_professional 2007
microsoft visio_standard 2007
microsoft windows_live_mail 2008
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:access:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "1B4D3093-F17C-4BCF-8F4A-F15057C55F82",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:excel:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F79E0AB-7081-4F97-BFE4-9AF84F643B9A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:excel:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A70D659-F648-4870-852A-4E86D1F4B646",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:frontpage:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C79FEE1-70A3-4A48-BE7B-0D18F0A5FA7F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:groove:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "355F60DB-EC9A-4054-8023-BD16D5723C9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:infopath:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "345BC07E-1558-4C27-BF1A-C13547D175FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:infopath:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "A007966C-7620-4625-AD2B-6A147577EB54",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "828219FA-E694-46DA-93B0-BE2EC5BBF61E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "69E6B9EB-D3F7-4C57-BF2F-61664E5C2C7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_communicator:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "61116145-828F-479D-9267-76BAB633B23E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:onenote:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "36BA88A3-A31F-4F90-8913-67D5BC00E72D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3189982-F780-4AC2-9663-E6D4DF9DD319",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "D789259A-034E-40BB-9DFF-76B3104B212F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:powerpoint:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5611EFD-2C7C-47BA-83E5-947EA00D8E6C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:powerpoint:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "A947639C-B1D3-4297-B4BB-AD799C979BE4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project_professional:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C58C5D7-B6F0-4C95-A305-ED37629E2A5A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project_standard:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8D468F3-894D-409E-A7CE-EAA5919362E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:publisher:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "617E8BE3-8AD0-42FC-BDEE-6B1F120AE512",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:publisher:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "190A4DF4-EA93-4E18-BA96-7A7AC48831F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sharepoint_designer:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E057F77-9197-4BC9-A0A1-A71850F59D70",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio_professional:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9A72192-B10A-4E42-AE68-FE1CB8DA573F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio_standard:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D837BA2-BAC0-4B72-A1DD-CB4A1CA5A347",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:windows_live_mail:2008:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD3CA537-AAF9-4356-AE7E-0AC14E5AFADF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension."
    },
    {
      "lang": "es",
      "value": "Microsoft Crypto API 5.131.2600.2180 hasta la 6.0, como las usadas en Outlook, Windows Live Mail, y Office 2007, realiza una lista de revocaci\u00f3n de certificado (CRL) utilizando una URL arbitraria de un certificado incluido en (1) mensaje de correo electr\u00f3nico S/MIME o (2) documento firmado, lo que permite a atacantes remotos conseguir tiempos de lectura  y direcciones IP de recipientes, y resultados de escaneo de puerto, a trav\u00e9s de \r\nun certificado manipulado con una extensi\u00f3n de de una Authority Information Access (AIA).\r\n"
    }
  ],
  "id": "CVE-2008-3068",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-07-07T23:41:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/3978"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/493947/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/494101/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/28548"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1019736"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1019737"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1019738"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.cynops.de/techzone/http_over_x509.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/3978"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/493947/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/494101/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/28548"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1019736"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1019737"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1019738"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.cynops.de/techzone/http_over_x509.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.