CVE-2008-3009

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 15.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-12-10 · updated 2026-06-16
Weakness: CWE-255

Description

Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."

Affected products

Microsoft Windows Media Format Runtime: 7.1, 11, 9.5, 9
Microsoft Corporation Windows Media Player: 6.4
Microsoft Windows Media Services: 4.1, 9, 2008

References

http://secunia.com/advisories/33058
http://www.securityfocus.com/bid/32653
http://www.securitytracker.com/id?1021372
http://www.securitytracker.com/id?1021373
http://www.us-cert.gov/cas/techalerts/TA08-344A.html
http://www.vupen.com/english/advisories/2008/3388
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-076
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5942
http://secunia.com/advisories/33058
http://www.securityfocus.com/bid/32653
http://www.securitytracker.com/id?1021372
http://www.securitytracker.com/id?1021373

Get alerted when CVE-2008-3009 or the next vulnerability affects your stack