CVE Vulnerability

CVE-2008-3009

Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."

10 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

References
Link Resource
http://www.securitytracker.com/id?1021372
http://www.securitytracker.com/id?1021373
http://www.securityfocus.com/bid/32653
http://www.us-cert.gov/cas/techalerts/TA08-344A.html US Government Resource
http://secunia.com/advisories/33058
http://www.vupen.com/english/advisories/2008/3388
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5942
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-076
Configurations

Configuration 1
Information

Published : 2008-12-10 02:00

Updated : 2019-02-26 02:04

NVD link : CVE-2008-3009

Mitre link : CVE-2008-3009

Products Affected
No products.
CWE
CWE-255