Lucene search

[email protected]CVE-2007-5355

HistoryDec 05, 2007 - 11:46 a.m.

CVE-2007-5355

2007-12-0511:46:00

[email protected]

web.nvd.nist.gov

cve-2007-5355

web proxy auto-discovery

wpad

internet explorer

dns

mitm

nvd

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.5 Medium

AI Score

Confidence

High

0.08 Low

EPSS

Percentile

94.3%

JSON

The Web Proxy Auto-Discovery (WPAD) feature in Microsoft Internet Explorer 6 and 7, when a primary DNS suffix with three or more components is configured, resolves an unqualified wpad hostname in a second-level domain outside this configured DNS domain, which allows remote WPAD servers to conduct man-in-the-middle (MITM) attacks.

Affected configurations

NVD

Node

microsoftwindows_2000sp4

AND

microsoftinternet_explorerMatch5.01sp4

Node

microsoftwindows_2000sp4

AND

microsoftinternet_explorerMatch6sp1

Node

microsoftwindows_2003_serverMatch64-bit

microsoftwindows_2003_serverMatch64-bit_sp2

microsoftwindows_2003_serverMatchitanium_sp1

microsoftwindows_2003_serverMatchitanium_sp2

microsoftwindows_2003_serverMatchsp1

microsoftwindows_2003_serverMatchsp2

microsoftwindows_xpsp2

AND

microsoftinternet_explorerMatch6

Node

microsoftwindows_2003_serverMatch64-bit

microsoftwindows_2003_serverMatch64-bit_sp2

microsoftwindows_2003_serverMatchitanium_sp1

microsoftwindows_2003_serverMatchitanium_sp2

microsoftwindows_2003_serverMatchsp1

microsoftwindows_2003_serverMatchsp2

microsoftwindows_vistax64

microsoftwindows_xpsp2

AND

microsoftinternet_explorerMatch7

CPENameOperatorVersion
microsoft:internet_explorermicrosoft internet explorereq5.01

CPE	Name	Operator	Version
microsoft:internet_explorer	microsoft internet explorer	eq	5.01

References

secunia.com/advisories/27901

support.microsoft.com/kb/945713

www.microsoft.com/technet/security/advisory/945713.mspx

www.securityfocus.com/bid/26686

www.securitytracker.com/id?1019033

www.vupen.com/english/advisories/2007/4064

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.5 Medium

AI Score

Confidence

High

0.08 Low

EPSS

Percentile

94.3%

JSON

Related for CVE-2007-5355

nvd1 seebug2 prion1 cvelist1