CVE-2008-3010

2008-12-1014:00:00

CWE-200

microsoft

web.nvd.nist.gov

microsoft

windows

isatap

vulnerability

cve-2008-3010

ntlm

remote servers

arbitrary code

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.5

Confidence

Low

EPSS

0.192

Percentile

96.4%

JSON

Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1 and 9 incorrectly associate ISATAP addresses with the Local Intranet zone, which allows remote servers to capture NTLM credentials, and execute arbitrary code through credential-reflection attacks, by sending an authentication request, aka “ISATAP Vulnerability.”

Affected configurations

Nvd

Node

microsoftwindows_media_playerMatch6.4

AND

microsoftwindows_2000sp4

microsoftwindows_2003_serversp1

microsoftwindows_2003_serversp2

microsoftwindows_2003_serversp2x64

microsoftwindows_server_2003x64

microsoftwindows_xppro_x64

microsoftwindows_xpsp2

microsoftwindows_xpsp2pro_x64

microsoftwindows_xpsp3

VendorProductVersionCPE
microsoftwindows_media_player6.4cpe:2.3:a:microsoft:windows_media_player:6.4:*:*:*:*:*:*:*
microsoftwindows_2000*cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
microsoftwindows_2003_server*cpe:2.3:o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:*
microsoftwindows_2003_server*cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
microsoftwindows_2003_server*cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*
microsoftwindows_server_2003*cpe:2.3:o:microsoft:windows_server_2003:*:x64:*:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:*:pro_x64:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:sp2:pro_x64:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows_media_player	6.4	cpe:2.3:a:microsoft:windows_media_player:6.4:::::::*
microsoft	windows_2000	*	cpe:2.3:o:microsoft:windows_2000::sp4::::::*
microsoft	windows_2003_server	*	cpe:2.3:o:microsoft:windows_2003_server::sp1::::::*
microsoft	windows_2003_server	*	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
microsoft	windows_2003_server	*	cpe:2.3:o:microsoft:windows_2003_server::sp2:x64:::::
microsoft	windows_server_2003	*	cpe:2.3:o:microsoft:windows_server_2003::x64::::::*
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp:::pro_x64:::::*
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp::sp2::::::*
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp::sp2:pro_x64:::::
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp::sp3::::::*