15 lines
No EOL
864 B
Text
15 lines
No EOL
864 B
Text
source: http://www.securityfocus.com/bid/28548/info
|
|
|
|
Microsoft's Crypto API library is prone to an information-disclosure vulnerability because HTTP requests to arbitrary hosts and ports may be automatically triggered when validating X.509 certificates.
|
|
|
|
Successful exploits allow attackers to trigger HTTP requests to arbitrary hosts and ports without confirmation or notification to unsuspecting users. Attackers may use this for determining when email and documents are read, for port scanning, or for aiding in other attacks.
|
|
|
|
The following products are known to exhibit this issue:
|
|
|
|
Microsoft Outlook 2007
|
|
Microsoft Windows Live Mail 2008
|
|
Microsoft Office 2007
|
|
|
|
Other products that use the Crypto API provided by Windows may also be affected.
|
|
|
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/31583.docx |