Oval Definition:	oval:org.mitre.oval:def:6149
Revision Date: 2013-04-29 Version: 49 Title: Windows HTTP Services Integer Underflow Vulnerability Description: Integer underflow in Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote HTTP servers to execute arbitrary code via crafted parameter values in a response, related to error handling, aka "Windows HTTP Services Integer Underflow Vulnerability." Family: windows Class: vulnerability Status: ACCEPTED Reference(s): CVE-2009-0086 Platform(s): Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP Product(s): Definition Synopsis winhttp.dll version 5.1.2600.3490 or later on Windows 2000 sp4 Microsoft Windows 2000 SP4 or later is installed AND system32\winhttp.dll version less than 5.1.2600.3490 OR winhttp.dll versin 5.1.2600.3494 or later on windows xp sp2 x86 Microsoft Windows XP (x86) SP2 is installed AND system32\winhttp.dll version less than 5.1.2600.3494 OR winhttp.dll versin 5.1.2600.5727 or later on windows xp sp3 x86 Microsoft Windows XP (x86) SP3 is installed AND system32\winhttp.dll version less than 5.1.2600.5727 OR winhttp.dll versin 5.2.3790.3262 or later on windows xp sp1 x64 Microsoft Windows XP SP1 (64-bit) is installed AND system32\winhttp.dll version less than 5.2.3790.3262 OR winhttp.dll versin 5.2.3790.4427 or later on windows xp sp2 x64 Microsoft Windows XP x64 Edition SP2 is installed AND system32\winhttp.dll version less than 5.2.3790.4427 OR winhttp.dll versin 5.2.3790.3262 or later on windows server 2003 sp1 (x86)(x64)(ia64) Windows Server 2003 SP1 Microsoft Windows Server 2003 SP1 (x86) is installed OR Microsoft Windows Server 2003 SP1 (x64) is installed OR Microsoft Windows Server 2003 SP1 for Itanium is installed AND Winsxs\winhttp.dll version less than 5.2.3790.3262 OR winhttp.dll versin 5.2.3790.4427 or later on windows server 2003 sp2 (x86)(x64)(ia64) Windows Server 2003 SP2 Microsoft Windows Server 2003 SP2 (x86) is installed OR Microsoft Windows Server 2003 SP2 (x64) is installed OR Microsoft Windows Server 2003 (ia64) SP2 is installed AND Winsxs\winhttp.dll version less than 5.2.3790.4427 OR winhttp.dll versin 6.0.6000.16786 or later on windows vista GDR (x86)(x64) Windows Vista Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed AND system32\winhttp.dll version greater than or equal 6.0.6000.16000 AND system32\winhttp.dll version less than 6.0.6000.16786 OR winhttp.dll versin 6.0.6000.20971 or later on windows vista LDR (x86)(x64) Windows Vista Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed AND system32\winhttp.dll version greater than or equal 6.0.6000.20000 AND system32\winhttp.dll version less than 6.0.6000.20971 OR winhttp.dll versin 6.0.6001.18178 or later on windows server 2008 sp1 GDR (x86)(x64)(ia64) and windows vista sp1 GDR (x86)(x64) OS section Microsoft Windows Vista (32-bit) Service Pack 1 is installed OR Microsoft Windows Vista x64 Edition Service Pack 1 is installed OR Microsoft Windows Server 2008 (32-bit) is installed OR Microsoft Windows Server 2008 (64-bit) is installed OR Microsoft Windows Server 2008 (ia-64) is installed AND system32\winhttp.dll version greater than or equal 6.0.6001.18000 AND system32\winhttp.dll version less than 6.0.6001.18178 OR winhttp.dll versin 6.0.6001.22323 or later on windows server 2008 sp1 LDR (x86)(x64)(ia64) and windows vista sp1 GDR (x86)(x64) OS section Microsoft Windows Vista (32-bit) Service Pack 1 is installed OR Microsoft Windows Vista x64 Edition Service Pack 1 is installed OR Microsoft Windows Server 2008 (32-bit) is installed OR Microsoft Windows Server 2008 (64-bit) is installed OR Microsoft Windows Server 2008 (ia-64) is installed AND system32\winhttp.dll version greater than or equal 6.0.6001.22000 AND system32\winhttp.dll version less than 6.0.6001.22323
BACK