Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2008-3009

Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."

Published

2008-12-10T14:00:00.720

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 10.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-255
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application microsoft windows_media_player 6.4 Yes
Operating System microsoft windows_2000 * No
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
Application microsoft windows_media_format_runtime 7.1 Yes
Operating System microsoft windows_2000 * No
Application microsoft windows_media_services 4.1 Yes
Operating System microsoft windows_2000 * No
Application microsoft windows_media_services 9 Yes
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_xp * No
Application microsoft windows_media_services 2008 Yes
Operating System microsoft windows_server_2008 * No
Operating System microsoft windows_server_2008 * No
Application microsoft windows_media_format_runtime 11 Yes
Operating System microsoft windows_server_2008 * No
Operating System microsoft windows_server_2008 * No
Operating System microsoft windows_vista * No
Operating System microsoft windows_vista * No
Operating System microsoft windows_vista gold No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
Application microsoft windows_media_format_runtime 11 Yes
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
Application microsoft windows_media_format_runtime 9.5 Yes
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
Application microsoft windows_media_format_runtime 9.5 Yes
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_server_2003 * No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
Application microsoft windows_media_format_runtime 9 Yes
Operating System microsoft windows_2000 * No
Operating System microsoft windows_xp * No
Operating System microsoft windows_xp * No
References