Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2009-0550
HistoryApr 15, 2009 - 8:00 a.m.

CVE-2009-0550

2009-04-1508:00:00
[email protected]
web.nvd.nist.gov
62
cve
2009
0550
winhttp
microsoft
windows
ntlm
credentials
arbitrary code
vulnerability
wininet
internet explorer
nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

6.9 Medium

AI Score

Confidence

Low

0.412 Medium

EPSS

Percentile

97.3%

JSON

Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008; and WinINet in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008; allows remote web servers to capture and replay NTLM credentials, and execute arbitrary code, via vectors related to absence of a โ€œcredential-reflection protectionsโ€ opt-in step, aka โ€œWindows HTTP Services Credential Reflection Vulnerabilityโ€ and โ€œWinINet Credential Reflection Vulnerability.โ€

Affected configurations

NVD
Node
microsoftwindows_2000sp4
OR
microsoftwindows_server_2003
OR
microsoftwindows_server_2003sp1
OR
microsoftwindows_server_2003sp1itanium
OR
microsoftwindows_server_2003sp2
OR
microsoftwindows_server_2008itanium
OR
microsoftwindows_server_2008x32
OR
microsoftwindows_server_2008x64
OR
microsoftwindows_vistax64
OR
microsoftwindows_vistasp1
OR
microsoftwindows_vistaMatchgold
OR
microsoftwindows_xppro_x64
OR
microsoftwindows_xpsp2
OR
microsoftwindows_xpsp2pro_x64
OR
microsoftwindows_xpsp3
Node
microsoftwindows_2000sp4
AND
microsoftieMatch6.0sp1
OR
microsoftinternet_explorerMatch5.01sp4
Node
microsoftinternet_explorerMatch6
AND
microsoftwindows_server_2003
OR
microsoftwindows_server_2003sp1
OR
microsoftwindows_server_2003sp1itanium
OR
microsoftwindows_server_2003sp2
OR
microsoftwindows_xppro_x64
OR
microsoftwindows_xpsp2
OR
microsoftwindows_xpsp2pro_x64
OR
microsoftwindows_xpsp3
Node
microsoftinternet_explorerMatch7
AND
microsoftwindows_server_2003
OR
microsoftwindows_server_2003sp1
OR
microsoftwindows_server_2003sp1itanium
OR
microsoftwindows_server_2003sp2
OR
microsoftwindows_server_2008
OR
microsoftwindows_server_200832_bit
OR
microsoftwindows_server_2008itanium
OR
microsoftwindows_server_2008x64
OR
microsoftwindows_vista
OR
microsoftwindows_vistax64
OR
microsoftwindows_vistasp1
OR
microsoftwindows_vistaMatchgold
OR
microsoftwindows_xpx64
OR
microsoftwindows_xpsp2
OR
microsoftwindows_xpsp2x64
OR
microsoftwindows_xpsp3

References

Related

saint 4
checkpoint_advisories 1
nvd 1
seebug 1
prion 1
cvelist 1
nessus 3
openvas 4
securityvulns 4
threatpost 1
mskb 1
saint
saint
Internet Explorer WinINet credential reflection vulnerability
2009-05-04 00:00:00
Internet Explorer WinINet credential reflection vulnerability
2009-05-04 00:00:00
Internet Explorer WinINet credential reflection vulnerability
2009-05-04 00:00:00
checkpoint_advisories
checkpoint_advisories
Microsoft Windows HTTP Services Credential Reflection Code Execution (MS09-013; CVE-2009-0550)
2009-04-14 00:00:00
nvd
nvd
CVE-2009-0550
2009-04-15 08:00:00
seebug
seebug
Microsoft Windows NTLMๅ‡ญๆฎๅๅฐ„่ฟœ็จ‹ไปฃ็ ๆ‰ง่กŒๆผๆดž๏ผˆMS09-013/MS09-014๏ผ‰
2009-04-16 00:00:00
prion
prion
Design/Logic Flaw
2009-04-15 08:00:00
cvelist
cvelist
CVE-2009-0550
2009-04-15 03:49:00
nessus
nessus
MS09-013: Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)
2009-04-15 00:00:00
MS09-014: Cumulative Security Update for Internet Explorer (963027)
2009-04-15 00:00:00
Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)
2018-04-03 00:00:00
openvas
openvas
Windows HTTP Services Could Allow Remote Code Execution Vulnerabilities (960803)
2009-04-15 00:00:00
Windows HTTP Services Could Allow Remote Code Execution Vulnerabilities (960803)
2009-04-15 00:00:00
Microsoft Internet Explorer Remote Code Execution Vulnerability (963027)
2009-04-15 00:00:00
securityvulns
securityvulns
Microsoft Security Bulletin MS09-013 - Critical Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)
2009-04-14 00:00:00
Microsoft Windows WinHTTP servive multiple security vulnerabilities
2009-04-14 00:00:00
Microsoft Security Bulletin MS09-014 - Critical Cumulative Security Update for Internet Explorer (963027)
2009-04-15 00:00:00
threatpost
threatpost
Microsoft plugs gaping holes in IE, Excel, Windows
2009-04-14 17:56:32
mskb
mskb
MS09-014: Cumulative security update for Internet Explorer
2012-07-18 16:19:51

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

6.9 Medium

AI Score

Confidence

Low

0.412 Medium

EPSS

Percentile

97.3%

JSON
Related for CVE-2009-0550
saint4checkpoint_advisories1nvd1seebug1prion1cvelist1nessus3openvas4securityvulns4threatpost1mskb1