Exploit Microsoft Crypto API X.509 Certificate Validation - Remote Information Disclosure

[Exploiter]

EDB-ID

31583

Проверка EDB

1. Пройдено

Автор

ALEXANDER KLINK

Тип уязвимости

REMOTE

Платформа

WINDOWS

CVE

N/A

Дата публикации

2008-03-31

source: https://www.securityfocus.com/bid/28548/info

Microsoft's Crypto API library is prone to an information-disclosure vulnerability because HTTP requests to arbitrary hosts and ports may be automatically triggered when validating X.509 certificates.

Successful exploits allow attackers to trigger HTTP requests to arbitrary hosts and ports without confirmation or notification to unsuspecting users. Attackers may use this for determining when email and documents are read, for port scanning, or for aiding in other attacks.

The following products are known to exhibit this issue:

Microsoft Outlook 2007
Microsoft Windows Live Mail 2008
Microsoft Office 2007

Other products that use the Crypto API provided by Windows may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31583.docx