What’s Vulnerable › Vulnerabilities

CVE-2008-3068

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 17.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2008-07-07 · updated 2026-06-16

Description

Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.

Affected products

• Microsoft Access: 2007
• Microsoft Excel 2013 Service Pack 1: 2003, 2007
• Microsoft Frontpage: 2003
• Microsoft Groove: 2007
• Microsoft Infopath: 2003, 2007
• Microsoft Office: 2007, 2007-sp1
• Microsoft Office Communicator: 2007
• Microsoft OneNote for Android: 2003
• Microsoft Outlook: 2003, 2007
• Microsoft PowerPoint for Android: 2003, 2007
• Microsoft Project Professional: 2007
• Microsoft Project Standard: 2007
• Microsoft Publisher: 2003, 2007
• Microsoft Sharepoint Designer: 2007
• Microsoft Visio Professional: 2007
• Microsoft Visio Standard: 2007
• Microsoft Windows Live Mail: 2008

References

• http://securityreason.com/securityalert/3978
• http://www.securityfocus.com/archive/1/493947/100/0/threaded
• http://www.securityfocus.com/archive/1/494101/100/0/threaded
• http://www.securityfocus.com/bid/28548
• http://www.securitytracker.com/id?1019736
• http://www.securitytracker.com/id?1019737
• http://www.securitytracker.com/id?1019738
• https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt
• https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt
• https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt
• https://www.cynops.de/techzone/http_over_x509.html
• https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt

Get alerted when CVE-2008-3068 or the next vulnerability affects your stack