CVE-2008-3068

published 2008-07-07

CVE-2008-3068: Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by…

Priority P3 48 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.

Affected

22 ranges

Vendor	Product	Version range	Fixed in
microsoft	access	—	—
microsoft	excel	—	—
microsoft	excel	—	—
microsoft	frontpage	—	—
microsoft	groove	—	—
microsoft	infopath	—	—
microsoft	infopath	—	—
microsoft	office	—	—
microsoft	office_communicator	—	—
microsoft	onenote	—	—
microsoft	outlook	—	—
microsoft	outlook	—	—
microsoft	powerpoint	—	—
microsoft	powerpoint	—	—
microsoft	project_professional	—	—
microsoft	project_standard	—	—
microsoft	publisher	—	—
microsoft	publisher	—	—
microsoft	sharepoint_designer	—	—
microsoft	visio_professional	—	—
microsoft	visio_standard	—	—
microsoft	windows_live_mail	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.