Vulnerabilities > CVE-2008-3009 - Credentials Management vulnerability in Microsoft products

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

microsoft

CWE-255

nessus

NVD

Published: 2008-12-10

Updated: 2024-11-21

Summary

Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."

Vulnerable Configurations

Part	Description	Count
Application	Microsoft Microsoft Windows Media Player 6.4 Microsoft Windows Media Format Runtime 7.1 Microsoft Windows Media Format Runtime 11 Microsoft Windows Media Format Runtime 9.5 Microsoft Windows Media Format Runtime 9 Microsoft Windows Media Services 4.1 Microsoft Windows Media Services 9 Microsoft Windows Media Services 2008	10
OS	Microsoft Microsoft Windows 2000 * Microsoft Windows Server 2003 * Microsoft Windows XP * Microsoft Windows Server 2008 * Microsoft Windows Vista * Microsoft Windows Vista Gold	14

Common Weakness Enumeration (CWE)

CWE-255 - Credentials Management

Msbulletin

bulletin_id	MS08-076
bulletin_url
date	2008-12-09T00:00:00
impact	Remote Code Execution
knowledgebase_id	959349
knowledgebase_url
severity	Important
title	Vulnerabilities in Windows Media Components Could Allow Remote Code Execution

Nessus

NASL family	Windows : Microsoft Bulletins
NASL id	SMB_NT_MS08-076.NASL
description	The remote host is running Windows Media Player/Components. There is a vulnerability in the remote version of this software that may allow an attacker to execute arbitrary code on the remote host thru flaws in ISATAP and SPN.
last seen	2020-06-01
modified	2020-06-02
plugin id	35075
published	2008-12-10
reporter	This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/35075
title	MS08-076: Vulnerabilities in Windows Media Components Could Allow Remote Code Execution (959807)
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(35075); script_version("1.30"); script_cvs_date("Date: 2018/11/15 20:50:30"); script_cve_id("CVE-2008-3009", "CVE-2008-3010"); script_bugtraq_id(32653, 32654); script_xref(name:"MSFT", value:"MS08-076"); script_xref(name:"MSKB", value:"952068"); script_xref(name:"MSKB", value:"952069"); script_xref(name:"MSKB", value:"954600"); script_xref(name:"IAVB", value:"2008-B-0081"); script_name(english:"MS08-076: Vulnerabilities in Windows Media Components Could Allow Remote Code Execution (959807)"); script_summary(english:"Checks the version of Media Format"); script_set_attribute(attribute:"synopsis", value: "Arbitrary code can be executed on the remote host through the Media Components."); script_set_attribute(attribute:"description", value: "The remote host is running Windows Media Player/Components. There is a vulnerability in the remote version of this software that may allow an attacker to execute arbitrary code on the remote host thru flaws in ISATAP and SPN."); script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2008/ms08-076"); script_set_attribute(attribute:"solution", value: "Microsoft has released a set of patches for Windows 2000, XP, 2003, Vista and Windows 2008."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(200, 255); script_set_attribute(attribute:"vuln_publication_date", value:"2008/12/09"); script_set_attribute(attribute:"patch_publication_date", value:"2008/12/09"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/12/10"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc."); script_family(english:"Windows : Microsoft Bulletins"); script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl"); script_require_keys("SMB/MS_Bulletin_Checks/Possible"); script_require_ports(139, 445, 'Host/patch_management_checks'); exit(0); } include("audit.inc"); include("smb_hotfixes_fcheck.inc"); include("smb_hotfixes.inc"); include("smb_func.inc"); include("misc_func.inc"); get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible"); bulletin = 'MS08-076'; kbs = make_list("952068", "952069", "954600"); if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE); get_kb_item_or_exit("SMB/Registry/Enumerated"); get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1); if (hotfix_check_sp_range(win2k:'4,5', xp:'2,3', win2003:'1,2', vista:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN); rootfile = hotfix_get_systemroot(); if (!rootfile) exit(1, "Failed to get the system root."); share = hotfix_path2share(path:rootfile); if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share); e = 0; # WMP kb = '954600'; e += hotfix_is_vulnerable(os:"5.0", file:"Strmdll.dll", version:"4.1.0.3937", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.1", file:"Strmdll.dll", version:"4.1.0.3937", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.2", file:"Strmdll.dll", version:"4.1.0.3937", dir:"\system32", bulletin:bulletin, kb:kb); # WMF Runtime and WMS on Vista/2k8 kb = '952069'; e += hotfix_is_vulnerable(os:"6.0", sp:1, file:"Wmvcore.dll", version:"11.0.6001.7105", min_version:"11.0.6001.7100", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"6.0", sp:1, file:"Wmvcore.dll", version:"11.0.6001.7001", min_version:"11.0.6001.0", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"6.0", sp:0, file:"Wmvcore.dll", version:"11.0.6000.6346", min_version:"11.0.6000.0", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"6.0", sp:0, file:"Wmvcore.dll", version:"11.0.6000.6505", min_version:"11.0.6000.6500", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"6.0", file:"Wmsserver.dll", version:"9.5.6001.18161", dir:"\system32", bulletin:bulletin, kb:kb); # WMS on 2k3 kb = '952068'; e += hotfix_is_vulnerable(os:"5.2", sp:2, file:"Wmsserver.dll", version:"9.1.1.5000", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.2", sp:1, file:"Wmsserver.dll", version:"9.1.1.3845", dir:"\system32", bulletin:bulletin, kb:kb); # WMF Runtime on 2k3 and XP x64 kb = '952069'; e += hotfix_is_vulnerable(os:"5.2", sp:1, arch:"x86", file:"Wmvcore.dll", version:"10.0.0.3711", min_version:"10.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.2", sp:2, arch:"x86", file:"Wmvcore.dll", version:"10.0.0.4001", min_version:"10.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.2", sp:1, arch:"x64", file:"Wmvcore.dll", version:"10.0.0.3711", min_version:"10.0.0.0", dir:"\syswow64", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.2", arch:"x64", file:"Wmvcore.dll", version:"10.0.0.3816", min_version:"10.0.0.3800", dir:"\syswow64", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.2", sp:2, arch:"x64", file:"Wmvcore.dll", version:"10.0.0.4001", min_version:"10.0.0.3900", dir:"\syswow64", bulletin:bulletin, kb:kb); # 32-bit WMF Runtime on XP x64 kb = '952069'; e += hotfix_is_vulnerable(os:"5.2", arch:"x64", file:"Wmvcore.dll", version:"11.0.5721.5251", min_version:"11.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb); # WMF Runtime on XP SP3 kb = '952069'; e += hotfix_is_vulnerable(os:"5.1", sp:3, file:"Wmvcore.dll", version:"9.0.0.4504", min_version:"9.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.1", sp:3, file:"Wmvcore.dll", version:"10.0.0.3703", min_version:"10.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.1", sp:3, file:"Wmvcore.dll", version:"10.0.0.4066", min_version:"10.0.0.4000", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.1", sp:3, file:"Wmvcore.dll", version:"10.0.0.4362", min_version:"10.0.0.4300", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.1", sp:3, file:"Wmvcore.dll", version:"11.0.5721.5251", min_version:"11.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb); # WMF Runtime on XP SP2 kb = '952069'; e += hotfix_is_vulnerable(os:"5.1", sp:2, file:"Wmvcore.dll", version:"9.0.0.3268", min_version:"9.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.1", sp:2, file:"Wmvcore.dll", version:"9.0.0.3358", min_version:"9.0.0.3300", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.1", sp:2, file:"Wmvcore.dll", version:"10.0.0.3703", min_version:"10.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.1", sp:2, file:"Wmvcore.dll", version:"10.0.0.4066", min_version:"10.0.0.4000", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.1", sp:2, file:"Wmvcore.dll", version:"10.0.0.4362", min_version:"10.0.0.4300", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.1", sp:2, file:"Wmvcore.dll", version:"11.0.5721.5251", min_version:"11.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb); # WMS on w2k kb = '952068'; e += hotfix_is_vulnerable(os:"5.0", file:"Wmvcore.dll", version:"9.0.0.3268", dir:"\system32", bulletin:bulletin, kb:kb); e += hotfix_is_vulnerable(os:"5.0", file:"Nscm.exe", version:"4.1.0.3936", bulletin:bulletin, kb:kb); if (e) { set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE); hotfix_security_hole(); hotfix_check_fversion_end(); exit(0); } else { hotfix_check_fversion_end(); audit(AUDIT_HOST_NOT, 'affected'); }

Oval

accepted

2014-08-18T04:06:05.949-04:00

class

vulnerability

contributors

name Sudhir Gandhe
organization Secure Elements, Inc.
name Dragos Prisaca
organization Gideon Technologies, Inc.
name Dragos Prisaca
organization Gideon Technologies, Inc.
name Dragos Prisaca
organization Symantec Corporation
name Pradeep R B
organization SecPod Technologies
name Maria Mikhno
organization ALTX-SOFT

definition_extensions

comment Windows Media Player 6.4 is installed.
oval oval:org.mitre.oval:def:6408
comment Microsoft Windows 2000 is installed
oval oval:org.mitre.oval:def:85
comment Microsoft Windows XP (32-bit) is installed
oval oval:org.mitre.oval:def:1353
comment Microsoft Windows Server 2003 (32-bit) is installed
oval oval:org.mitre.oval:def:1870
comment Microsoft Windows XP x64 is installed
oval oval:org.mitre.oval:def:15247
comment Microsoft Windows Server 2003 (x64) is installed
oval oval:org.mitre.oval:def:730
comment Microsoft Media Services 4.1 is installed
oval oval:org.mitre.oval:def:5705
comment Microsoft Windows 2000 is installed
oval oval:org.mitre.oval:def:85
comment Microsoft Media Services 9 is installed
oval oval:org.mitre.oval:def:5844
comment Microsoft Windows Server 2003 (32-bit) is installed
oval oval:org.mitre.oval:def:1870
comment Microsoft Windows Server 2003 (32-bit) is installed
oval oval:org.mitre.oval:def:1870
comment Microsoft Windows Server 2008 (32-bit) is installed
oval oval:org.mitre.oval:def:4870
comment Microsoft Windows Server 2008 (64-bit) is installed
oval oval:org.mitre.oval:def:5356
comment Windows Media Player v7.1 is installed.
oval oval:org.mitre.oval:def:1386
comment Microsoft Windows 2000 is installed
oval oval:org.mitre.oval:def:85
comment Windows Media Player v9 is installed.
oval oval:org.mitre.oval:def:2147
comment Microsoft Windows 2000 is installed
oval oval:org.mitre.oval:def:85
comment Microsoft Windows XP is installed
oval oval:org.mitre.oval:def:105
comment Microsoft Windows XP (32-bit) is installed
oval oval:org.mitre.oval:def:1353
comment Windows Media Player v10 is installed.
oval oval:org.mitre.oval:def:2172
comment Microsoft Windows XP is installed
oval oval:org.mitre.oval:def:105
comment Microsoft Windows XP (32-bit) is installed
oval oval:org.mitre.oval:def:1353
comment Microsoft Windows Server 2003 (32-bit) is installed
oval oval:org.mitre.oval:def:1870
comment Microsoft Windows Server 2003 (32-bit) is installed
oval oval:org.mitre.oval:def:1870
comment Microsoft Windows XP x64 is installed
oval oval:org.mitre.oval:def:15247
comment Microsoft Windows Server 2003 (x64) is installed
oval oval:org.mitre.oval:def:730
comment Microsoft Windows XP x64 is installed
oval oval:org.mitre.oval:def:15247
comment Microsoft Windows Server 2003 (x64) is installed
oval oval:org.mitre.oval:def:730
comment Windows Media Player v11 is installed.
oval oval:org.mitre.oval:def:2126
comment Microsoft Windows XP is installed
oval oval:org.mitre.oval:def:105
comment Microsoft Windows XP (32-bit) is installed
oval oval:org.mitre.oval:def:1353
comment Microsoft Windows XP x64 is installed
oval oval:org.mitre.oval:def:15247
comment Microsoft Windows Vista x64 Edition is installed
oval oval:org.mitre.oval:def:2041
comment Microsoft Windows Vista (32-bit) is installed
oval oval:org.mitre.oval:def:1282
comment Microsoft Windows Vista (32-bit) is installed
oval oval:org.mitre.oval:def:1282
comment Microsoft Windows Server 2008 (32-bit) is installed
oval oval:org.mitre.oval:def:4870
comment Microsoft Windows Vista x64 Edition is installed
oval oval:org.mitre.oval:def:2041
comment Microsoft Windows Server 2008 (64-bit) is installed
oval oval:org.mitre.oval:def:5356

description

family

windows

oval:org.mitre.oval:def:5942

status

accepted

submitted

2008-12-10T10:44:00

title

SPN Vulnerability

version

Seebug

bulletinFamily	exploit
description	BUGTRAQ ID: 32653 CVE(CAN) ID: CVE-2008-3009 Windows媒体组件包括Windows Media Player、Windows Media Format Runtime和Windows Media Services等多种服务和应用。 Windows媒体组件在使用NTLM认证协议（具体来说，是SPN）的方式存在安全漏洞。在访问媒体之前，服务器会提示一些使用Windows媒体组件的媒体播放器（如Windows Media Player）要求进行认证，然后客户端会在响应中发送当前用户的凭据，可能为使用NTLM的凭据。如果服务器为恶意服务器的话，就可能使用所接收到的NTLM凭据对客户端执行反射攻击。请注意Windows Media媒体组件是区分区域的，也就是说在从服务器检索媒体时，要判断服务器是处于本地Intranet区还是Internet区。处于Internet区中的服务器是不受信任的，未经提示用户Windows媒体组件不会向该区中的服务器发送NTLM凭据。因此，如果要利用SPN漏洞，攻击者必须处于本地Intranet（也就是与受害用户处于同一子网）或能够诱骗系统用Internet中的机器执行NTLM认证。 Microsoft Windows Media Player 6.4 Microsoft Windows Media Services 9.1 Microsoft Windows Media Services 9.0 Series Microsoft Windows Media Services 4.1 Microsoft Windows Media Services 2008 Microsoft Windows Media Format Runtime 9.5 Microsoft Windows Media Format Runtime 9 Microsoft Windows Media Format Runtime 7.1 Microsoft Windows Media Format Runtime 11 Microsoft --------- Microsoft已经为此发布了一个安全公告（MS08-076）以及相应补丁: MS08-076：Vulnerabilities in Windows Media Components Could Allow Remote Code Execution (959807) 链接：<a href=http://www.microsoft.com/technet/security/Bulletin/ms08-076.mspx?pf=true target=_blank>http://www.microsoft.com/technet/security/Bulletin/ms08-076.mspx?pf=true</a>
id	SSV:4553
last seen	2017-11-19
modified	2008-12-11
published	2008-12-11
reporter	Root
title	Microsoft Windows媒体组件SPN实现远程代码执行漏洞（MS08-076）

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Msbulletin

Nessus

Oval

Seebug

References