PT-2008-1737 · Microsoft · Windows Messenger

Haifei Li + 1 · Published 2008-08-13 · Updated 2018-10-15 · CVE-2008-0082

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Messenger versions 4.7 through 5.1

Description The issue allows remote attackers to control the Messenger application, change its state, obtain contact information, and establish audio or video connections without notification. This is due to an ActiveX control, Messenger.UIAutomation.1, being marked as safe-for-scripting.

Recommendations For Windows Messenger versions 4.7 through 5.1, consider disabling the Messenger.UIAutomation.1 ActiveX control as a temporary workaround to minimize the risk of exploitation. Restrict access to the Messenger application to prevent unauthorized control and data access.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-0082

Affected Products

Windows Messenger

References · 10

• http://secunia.com/advisories/31446 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-050 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0082 · Security Note
• http://marc.info/?l=bugtraq&m=121915960406986&w=2 · Vendor Advisory
• http://securityfocus.com/bid/30551 · Note
• http://us-cert.gov/cas/techalerts/TA08-225A.html · Note
• http://vupen.com/english/advisories/2008/2354 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5995 · Note
• http://securityfocus.com/archive/1/495467/100/0/threaded · Note
• http://securitytracker.com/id?1020681 · Note