CVE-2008-3068
- State
- Published
- Severity
- Not scored
- Published
- Jul 7, 2008
- Updated
- Aug 7, 2024
- Reserved
- Jul 7, 2008
Description
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt
- 3978third-party-advisory
- 20080709 Re: Unauthorized reading confirmation from Outlookmailing-list
- 28548vdb-entry
- https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt
- https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt
- https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt
- 1019736vdb-entry
- 1019738vdb-entry
- https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt
- https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt
- 1019737vdb-entry
- https://www.cynops.de/techzone/http_over_x509.html
- 20080703 Unauthorized reading confirmation from Outlookmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.