PT-2008-4442 · Microsoft · Windows Media Services+2

Publicado 2008-12-10 · Atualizado 2018-10-12 · CVE-2008-3010

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Media Player version 6.4 Windows Media Format Runtime versions 7.1 through 11 Windows Media Services versions 4.1 and 9

Description The issue allows remote servers to capture NTLM credentials and execute arbitrary code through credential-reflection attacks by sending an authentication request. This occurs because the software incorrectly associates ISATAP addresses with the Local Intranet zone.

Recommendations For Microsoft Windows Media Player version 6.4, update to a version that correctly handles ISATAP addresses. For Windows Media Format Runtime versions 7.1 through 11, update to a version that correctly handles ISATAP addresses. For Windows Media Services versions 4.1 and 9, update to a version that correctly handles ISATAP addresses.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-3010

Produtos afetados

Windows Media Format Runtime

Windows Media Player

Windows Media Services

Referências · 9

• http://securitytracker.com/id?1021375 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5689 · Nota
• http://secunia.com/advisories/33058 · Nota
• http://securitytracker.com/id?1021374 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3010 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-076 · Aviso do Fabricante
• http://securityfocus.com/bid/32654 · Nota
• http://vupen.com/english/advisories/2008/3388 · Nota
• http://us-cert.gov/cas/techalerts/TA08-344A.html · Nota