Oval Definition:	oval:org.mitre.oval:def:6027
Revision Date: 2013-04-29 Version: 49 Title: Windows HTTP Services Certificate Name Mismatch Vulnerability Description: Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Vista Gold allows remote web servers to impersonate arbitrary https web sites by using DNS spoofing to "forward a connection" to a different https web site that has a valid certificate matching its own domain name, but not a certificate matching the domain name of the host requested by the user, aka "Windows HTTP Services Certificate Name Mismatch Vulnerability." Family: windows Class: vulnerability Status: ACCEPTED Reference(s): CVE-2009-0089 Platform(s): Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP Product(s): Definition Synopsis winhttp.dll version 5.1.2600.3490 or later on Windows 2000 sp4 Microsoft Windows 2000 SP4 or later is installed AND system32\winhttp.dll version less than 5.1.2600.3490 OR winhttp.dll versin 5.1.2600.3494 or later on windows xp sp2 x86 Microsoft Windows XP (x86) SP2 is installed AND system32\winhttp.dll version less than 5.1.2600.3494 OR winhttp.dll versin 5.1.2600.5727 or later on windows xp sp3 x86 Microsoft Windows XP (x86) SP3 is installed AND system32\winhttp.dll version less than 5.1.2600.5727 OR winhttp.dll versin 5.2.3790.3262 or later on windows xp sp1 x64 Microsoft Windows XP SP1 (64-bit) is installed AND system32\winhttp.dll version less than 5.2.3790.3262 OR winhttp.dll versin 5.2.3790.4427 or later on windows xp sp2 x64 Microsoft Windows XP x64 Edition SP2 is installed AND system32\winhttp.dll version less than 5.2.3790.4427 OR winhttp.dll versin 5.2.3790.3262 or later on windows server 2003 sp1 (x86)(x64)(ia64) OS section Microsoft Windows Server 2003 SP1 (x86) is installed OR Microsoft Windows Server 2003 SP1 (x64) is installed OR Microsoft Windows Server 2003 SP1 for Itanium is installed AND Winsxs\winhttp.dll version less than 5.2.3790.3262 OR winhttp.dll versin 5.2.3790.4427 or later on windows server 2003 sp2 (x86)(x64)(ia64) OS section Microsoft Windows Server 2003 SP2 (x86) is installed OR Microsoft Windows Server 2003 SP2 (x64) is installed OR Microsoft Windows Server 2003 (ia64) SP2 is installed AND Winsxs\winhttp.dll version less than 5.2.3790.4427 OR winhttp.dll versin 6.0.6000.16786 or later on windows vista GDR (x86)(x64) OS section Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed AND system32\winhttp.dll version greater than or equal 6.0.6000.16000 AND system32\winhttp.dll version less than 6.0.6000.16786 OR winhttp.dll versin 6.0.6000.20971 or later on windows vista LDR (x86)(x64) OS section Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed AND system32\winhttp.dll version greater than or equal 6.0.6000.20000 AND system32\winhttp.dll version less than 6.0.6000.20971 OR winhttp.dll versin 6.0.6001.18178 or later on windows server 2008 sp1 GDR (x86)(x64)(ia64) and windows vista sp1 GDR (x86)(x64) Microsoft Windows Vista (32-bit) Service Pack 1 is installed AND system32\winhttp.dll version greater than or equal 6.0.6001.18000 AND system32\winhttp.dll version less than 6.0.6001.18178 OR winhttp.dll versin 6.0.6001.22323 or later on windows server 2008 sp1 LDR (x86)(x64)(ia64) and windows vista sp1 GDR (x86)(x64) Microsoft Windows Vista (32-bit) Service Pack 1 is installed AND system32\winhttp.dll version greater than or equal 6.0.6001.22000 AND system32\winhttp.dll version less than 6.0.6001.22323
BACK