CVEvulnerability

CVE-2008-3009

10.0 HIGH Published 2008-12-10 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-12-10
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-255

Description

Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."

Affected configurations

• microsoft windows media player 6.4 • microsoft windows media format runtime 7.1 • microsoft windows media services 4.1 • microsoft windows media services 9 • microsoft windows media services 2008 • microsoft windows media format runtime 11 • microsoft windows media format runtime 9.5 • microsoft windows media format runtime 9

Related

Weakness · not in database (1)

References