Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
2008-07-07T23:41:00.000
2025-04-09T00:30:58.490
Deferred
CVSSv2: 7.5 (HIGH)
AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | microsoft | access | 2007 | Yes |
| Application | microsoft | excel | 2003 | Yes |
| Application | microsoft | excel | 2007 | Yes |
| Application | microsoft | frontpage | 2003 | Yes |
| Application | microsoft | groove | 2007 | Yes |
| Application | microsoft | infopath | 2003 | Yes |
| Application | microsoft | infopath | 2007 | Yes |
| Application | microsoft | office | 2007 | Yes |
| Application | microsoft | office | 2007 | Yes |
| Application | microsoft | office_communicator | 2007 | Yes |
| Application | microsoft | onenote | 2003 | Yes |
| Application | microsoft | outlook | 2003 | Yes |
| Application | microsoft | outlook | 2007 | Yes |
| Application | microsoft | powerpoint | 2003 | Yes |
| Application | microsoft | powerpoint | 2007 | Yes |
| Application | microsoft | project_professional | 2007 | Yes |
| Application | microsoft | project_standard | 2007 | Yes |
| Application | microsoft | publisher | 2003 | Yes |
| Application | microsoft | publisher | 2007 | Yes |
| Application | microsoft | sharepoint_designer | 2007 | Yes |
| Application | microsoft | visio_professional | 2007 | Yes |
| Application | microsoft | visio_standard | 2007 | Yes |
| Application | microsoft | windows_live_mail | 2008 | Yes |