CVE-2008-3068
Publicada em · Atualizada em
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 17%
probabilidade de exploração
17%top 3% das CVEs
exploração observada
nãonenhuma fonte reporta
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
Produtos afetados
n/a · n/aReferências
http://securityreason.com/securityalert/3978https://www.cynops.de/advisories/AKLINK-SA-2008-002.txthttps://www.cynops.de/advisories/AKLINK-SA-2008-003.txthttps://www.cynops.de/advisories/AKLINK-SA-2008-004.txthttps://www.cynops.de/techzone/http_over_x509.htmlhttps://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txthttps://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txthttps://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txthttp://www.securityfocus.com/archive/1/493947/100/0/threadedhttp://www.securityfocus.com/archive/1/494101/100/0/threadedhttp://www.securityfocus.com/bid/28548http://www.securitytracker.com/id?1019736