Vulnerability Name:

CVE-2009-0550 (CCN-49549)

Assigned:2009-04-14
Published:2009-04-14
Updated:2021-07-23
Summary:Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008; and WinINet in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008; allows remote web servers to capture and replay NTLM credentials, and execute arbitrary code, via vectors related to absence of a "credential-reflection protections" opt-in step, aka "Windows HTTP Services Credential Reflection Vulnerability" and "WinINet Credential Reflection Vulnerability."
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MISC
Type: UNKNOWN
http://blogs.technet.com/srd/archive/2009/04/14/ntlm-credential-reflection-updates-for-http-clients.aspx

Source: MITRE
Type: CNA
CVE-2009-0550

Source: OSVDB
Type: UNKNOWN
53619

Source: CCN
Type: SA34677
Microsoft Windows HTTP Services Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
34677

Source: CCN
Type: SA34678
Microsoft Internet Explorer Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
34678

Source: CCN
Type: SECTRACK ID: 1022041
Windows HTTP Services Bugs Let Remote Users Execute Arbitrary Code

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm

Source: CCN
Type: ASA-2009-133
MS09-014 Cumulative Security Update for Internet Explorer (963027)

Source: CCN
Type: ASA-2009-135
MS09-013 Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)

Source: CCN
Type: NORTEL BULLETIN ID: 2009009451, Rev 1
Nortel Response to Microsoft Security Bulletin MS09-014

Source: CONFIRM
Type: UNKNOWN
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=871138

Source: CCN
Type: Microsoft Security Bulletin MS09-013
Vulnerabilities in Windows HTTP services could allow Remote Code Execution (960803)

Source: CCN
Type: Microsoft Security Bulletin MS09-014
Cumulative Security Update for Internet Explorer (963027)

Source: CCN
Type: OSVDB ID: 53619
Microsoft Windows HTTP Services NTLM Credential Replay Privileged Code Execution

Source: BID
Type: UNKNOWN
34439

Source: CCN
Type: BID-34439
Microsoft Windows NTLM Credential Reflection Remote Code Execution Vulnerability

Source: SECTRACK
Type: UNKNOWN
1022041

Source: CERT
Type: US Government Resource
TA09-104A

Source: VUPEN
Type: UNKNOWN
ADV-2009-1027

Source: VUPEN
Type: UNKNOWN
ADV-2009-1028

Source: MS
Type: UNKNOWN
MS09-013

Source: MS
Type: UNKNOWN
MS09-014

Source: XF
Type: UNKNOWN
ie-wininet-code-execution(49549)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:5320

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:6233

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:7569

Vulnerable Configuration:Configuration 1:
  • cpe:/o:microsoft:windows_xp:*:*:pro_x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp2:pro_x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:gold:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp1:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
  • AND
  • cpe:/a:microsoft:ie:6.0:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:microsoft:internet_explorer:6:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_xp:*:sp2:pro_x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:*:pro_x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp1:itanium:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:microsoft:internet_explorer:7:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:gold:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp1:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_xp:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:ie:6.0:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server::x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server:sp1_itanium:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp::sp2:x64:*:professional:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp1:x64:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows:xp:sp3:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:7569
    V
    		WinINet and Windows HTTP Services Credential Reflection Vulnerability
    2014-08-18
    BACK
    microsoft windows xp *
    microsoft windows xp * sp2
    microsoft windows vista gold
    microsoft windows server 2008 *
    microsoft windows vista * sp1
    microsoft windows 2000 * sp4
    microsoft windows server 2003 *
    microsoft windows server 2003 * sp1
    microsoft windows vista * sp1
    microsoft windows vista *
    microsoft windows server 2003 * sp2
    microsoft windows xp * sp2
    microsoft windows server 2003 * sp1
    microsoft windows server 2008 *
    microsoft windows server 2008 *
    microsoft windows xp * sp3
    microsoft windows 2000 * sp4
    microsoft ie 6.0 sp1
    microsoft internet explorer 5.01 sp4
    microsoft internet explorer 6
    microsoft windows xp * sp2
    microsoft windows server 2003 *
    microsoft windows server 2003 * sp2
    microsoft windows xp *
    microsoft windows xp * sp3
    microsoft windows server 2003 * sp1
    microsoft windows xp * sp2
    microsoft windows server 2003 * sp1
    microsoft internet explorer 7
    microsoft windows xp * sp2
    microsoft windows xp * sp3
    microsoft windows vista *
    microsoft windows xp * sp2
    microsoft windows server 2003 *
    microsoft windows vista gold
    microsoft windows server 2003 * sp1
    microsoft windows server 2008 *
    microsoft windows xp *
    microsoft windows server 2003 * sp1
    microsoft windows server 2003 * sp2
    microsoft windows server 2008 *
    microsoft windows vista * sp1
    microsoft windows server 2008 *
    microsoft windows server 2008 *
    microsoft windows vista *
    microsoft windows vista * sp1
    microsoft ie 6.0
    microsoft ie 6.0 sp1
    microsoft windows 2000 - sp4
    microsoft windows 2003_server
    microsoft windows xp sp2
    microsoft windows 2003_server sp1
    microsoft windows 2003_server sp1_itanium
    microsoft ie 7.0
    microsoft windows vista *
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows vista -
    microsoft windows xp sp2
    microsoft windows vista - sp1
    microsoft windows vista - sp1
    microsoft ie 5.0.1 sp4
    microsoft windows server 2008 -
    microsoft windows server 2008 -
    microsoft windows server 2008 -
    microsoft windows xp sp3