CVE

Id
37985  
CVE No.
CVE-2009-0550  
Status
Candidate  
Description
Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008; and WinINet in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008; allows remote web servers to capture and replay NTLM credentials, and execute arbitrary code, via vectors related to absence of a "credential-reflection protections" opt-in step, aka "Windows HTTP Services Credential Reflection Vulnerability" and "WinINet Credential Reflection Vulnerability."  
Phase
Assigned (20090212)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
412545 37985 CVE-2009-0550 MISC:http://blogs.technet.com/srd/archive/2009/04/14/ntlm-credential-reflection-updates-for-http-clients.aspx  View
412546 37985 CVE-2009-0550 CONFIRM:http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm  View
412547 37985 CVE-2009-0550 CONFIRM:http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=871138  View
412548 37985 CVE-2009-0550 MS:MS09-013  View
412549 37985 CVE-2009-0550 URL:http://www.microsoft.com/technet/security/Bulletin/MS09-013.mspx  View
412550 37985 CVE-2009-0550 MS:MS09-014  View
412551 37985 CVE-2009-0550 URL:http://www.microsoft.com/technet/security/Bulletin/MS09-014.mspx  View
412552 37985 CVE-2009-0550 CERT:TA09-104A  View
412553 37985 CVE-2009-0550 URL:http://www.us-cert.gov/cas/techalerts/TA09-104A.html  View
412554 37985 CVE-2009-0550 BID:34439  View
412555 37985 CVE-2009-0550 URL:http://www.securityfocus.com/bid/34439  View
412556 37985 CVE-2009-0550 OSVDB:53619  View
412557 37985 CVE-2009-0550 URL:http://osvdb.org/53619  View
412558 37985 CVE-2009-0550 OVAL:oval:org.mitre.oval:def:5320  View
412559 37985 CVE-2009-0550 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5320  View
412560 37985 CVE-2009-0550 OVAL:oval:org.mitre.oval:def:6233  View
412561 37985 CVE-2009-0550 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6233  View
412562 37985 CVE-2009-0550 OVAL:oval:org.mitre.oval:def:7569  View
412563 37985 CVE-2009-0550 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7569  View
412564 37985 CVE-2009-0550 SECTRACK:1022041  View
412565 37985 CVE-2009-0550 URL:http://www.securitytracker.com/id?1022041  View
412566 37985 CVE-2009-0550 SECUNIA:34677  View
412567 37985 CVE-2009-0550 URL:http://secunia.com/advisories/34677  View
412568 37985 CVE-2009-0550 SECUNIA:34678  View
412569 37985 CVE-2009-0550 URL:http://secunia.com/advisories/34678  View
412570 37985 CVE-2009-0550 VUPEN:ADV-2009-1027  View
412571 37985 CVE-2009-0550 URL:http://www.vupen.com/english/advisories/2009/1027  View
412572 37985 CVE-2009-0550 VUPEN:ADV-2009-1028  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
40206 JVNDB-2009-001212 Microsoft Internet Explorer における初期化されていないメモリに関する任意のコードを実行される脆弱性 Microsoft Internet Explorer には、正しく初期化されていない、または削除されたメモリ内のオブジェクトにアクセスする処理に不備があるため、任意のコードを実行される脆弱性が存在します。 CVE-2009-0554 37985 9.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001212.html  View