PT-2008-1737 · Microsoft · Windows Messenger

Haifei Li + 1 · Publicado 2008-08-13 · Atualizado 2018-10-15 · CVE-2008-0082

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Messenger versions 4.7 through 5.1

Description The issue allows remote attackers to control the Messenger application, change its state, obtain contact information, and establish audio or video connections without notification. This is due to an ActiveX control, Messenger.UIAutomation.1, being marked as safe-for-scripting.

Recommendations For Windows Messenger versions 4.7 through 5.1, consider disabling the Messenger.UIAutomation.1 ActiveX control as a temporary workaround to minimize the risk of exploitation. Restrict access to the Messenger application to prevent unauthorized control and data access.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-0082

Produtos afetados

Windows Messenger

Referências · 10

• http://securityfocus.com/bid/30551 · Nota
• http://us-cert.gov/cas/techalerts/TA08-225A.html · Nota
• http://secunia.com/advisories/31446 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2354 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5995 · Nota
• http://securityfocus.com/archive/1/495467/100/0/threaded · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-050 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-0082 · Nota de Segurança
• http://securitytracker.com/id?1020681 · Nota
• http://marc.info/?l=bugtraq&m=121915960406986&w=2 · Aviso do Fabricante