Vulnerability in Microsoft Access
CVE-2008-3068
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.174 (97.0th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.174 · newest: 0.174 · change: 0.000
Affected products
- Microsoft Access — versions 2007
- Microsoft Excel — versions 2003, 2007
- Microsoft Frontpage — versions 2003
- Microsoft Groove — versions 2007
- Microsoft Infopath — versions 2003, 2007
- Microsoft Office — versions 2007
- Microsoft Office Communicator — versions 2007
- Microsoft Onenote — versions 2003
- Microsoft Outlook — versions 2003, 2007
- Microsoft Powerpoint — versions 2003, 2007
References
- www.cynops.de/advisories/AKLINK-SA-2008-003.txt
- securityreason.com/securityalert/3978 (third-party-advisory)
- www.securityfocus.com/archive/1/494101/100/0/threaded (mailing-list)
- www.securityfocus.com/bid/28548 (vdb-entry)
- www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt
- www.cynops.de/advisories/AKLINK-SA-2008-002.txt
- www.cynops.de/advisories/AKLINK-SA-2008-004.txt
- www.securitytracker.com/id (vdb-entry)
- www.securitytracker.com/id (vdb-entry)
- www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt