CVE-2008-5828

2009-01-0219:30:01

CWE-200

[email protected]

web.nvd.nist.gov

cve-2008-5828

microsoft windows live messenger

remote attackers

intranet ip addresses

port numbers

security vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.7 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.9%

JSON

Microsoft Windows Live Messenger Client 8.5.1 and earlier, when MSN Protocol Version 15 (MSNP15) is used over a NAT session, allows remote attackers to discover intranet IP addresses and port numbers by reading the (1) IPv4InternalAddrsAndPorts, (2) IPv4Internal-Addrs, and (3) IPv4Internal-Port header fields.

Affected configurations

NVD

Node

microsoftwindows_live_messengerRange≤8.5.1

microsoftwindows_live_messengerMatch8.0

microsoftwindows_live_messengerMatch8.1

microsoftwindows_live_messengerMatch8.5

CPENameOperatorVersion
microsoft:windows_live_messengermicrosoft windows live messengerle8.5.1
microsoft:windows_live_messengermicrosoft windows live messengereq8.0
microsoft:windows_live_messengermicrosoft windows live messengereq8.1
microsoft:windows_live_messengermicrosoft windows live messengereq8.5

CPE	Name	Operator	Version
microsoft:windows_live_messenger	microsoft windows live messenger	le	8.5.1
microsoft:windows_live_messenger	microsoft windows live messenger	eq	8.0
microsoft:windows_live_messenger	microsoft windows live messenger	eq	8.1
microsoft:windows_live_messenger	microsoft windows live messenger	eq	8.5