CVE-2008-3009
Published · Updated
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 16%
exploitation probability
16%top 3% of all CVEs
observed exploitation
nono source reports it
Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."
Affected products
n/a · n/aReferences
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-076http://secunia.com/advisories/33058https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5942http://www.securityfocus.com/bid/32653http://www.securitytracker.com/id?1021372http://www.securitytracker.com/id?1021373http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlhttp://www.vupen.com/english/advisories/2008/3388