CVE-2008-3009

2008-12-1014:00:00

CWE-255

[email protected]

web.nvd.nist.gov

microsoft

windows media player

spn vulnerability

cve-2008-3009

nvd

7.7 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.143 Low

EPSS

Percentile

95.7%

JSON

Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka “SPN Vulnerability.”

CPENameOperatorVersion
microsoft:windows_media_playermicrosoft windows media playereq6.4
microsoft:windows_media_format_runtimemicrosoft windows media format runtimeeq7.1
microsoft:windows_media_servicesmicrosoft windows media serviceseq4.1
microsoft:windows_media_servicesmicrosoft windows media serviceseq9
microsoft:windows_media_servicesmicrosoft windows media serviceseq2008
microsoft:windows_media_format_runtimemicrosoft windows media format runtimeeq11
microsoft:windows_media_format_runtimemicrosoft windows media format runtimeeq9.5
microsoft:windows_media_format_runtimemicrosoft windows media format runtimeeq9

CPE	Name	Operator	Version
microsoft:windows_media_player	microsoft windows media player	eq	6.4
microsoft:windows_media_format_runtime	microsoft windows media format runtime	eq	7.1
microsoft:windows_media_services	microsoft windows media services	eq	4.1
microsoft:windows_media_services	microsoft windows media services	eq	9
microsoft:windows_media_services	microsoft windows media services	eq	2008
microsoft:windows_media_format_runtime	microsoft windows media format runtime	eq	11
microsoft:windows_media_format_runtime	microsoft windows media format runtime	eq	9.5
microsoft:windows_media_format_runtime	microsoft windows media format runtime	eq	9