NVD

Id
47881  
Name
CVE-2009-0550  
Description
Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008; and WinINet in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008; allows remote web servers to capture and replay NTLM credentials, and execute arbitrary code, via vectors related to absence of a "credential-reflection protections" opt-in step, aka "Windows HTTP Services Credential Reflection Vulnerability" and "WinINet Credential Reflection Vulnerability."  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-04-15  
Modified Date
2010-08-21  
Seq
2009-0550  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
239883 47881 CVE-2009-0550 http://blogs.technet.com/srd/archive/2009/04/14/ntlm-credential-reflection-updates-for-http-clients.aspx  View
239884 47881 CVE-2009-0550 oval:org.mitre.oval:def:5320  View
239885 47881 CVE-2009-0550 oval:org.mitre.oval:def:6233  View
239886 47881 CVE-2009-0550 oval:org.mitre.oval:def:7569  View
239887 47881 CVE-2009-0550 http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm  View
239888 47881 CVE-2009-0550 http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=871138  View
239889 47881 CVE-2009-0550 MS09-013  View
239890 47881 CVE-2009-0550 MS09-014  View
239891 47881 CVE-2009-0550 34439  View
239892 47881 CVE-2009-0550 1022041  View
239893 47881 CVE-2009-0550 TA09-104A  View
239894 47881 CVE-2009-0550 ADV-2009-1027  View
239895 47881 CVE-2009-0550 ADV-2009-1028  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40200 JVNDB-2009-001206 Microsoft Windows の Windows HTTP サービスにおける NTLM 認証の処理に関する任意のコードを実行される脆弱性 Microsoft Windows の Windows HTTP サービス および Microsoft Internet Explorer の WinINet には、NTLM 認証の処理に不備があるため、任意のコードを実行される脆弱性が存在します。 CVE-2009-0550 37981 CVE-2009-0550 47881 9.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001206.html 2009-04-14 2009-05-12 View