Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Vista Gold allows remote web servers to impersonate arbitrary https web sites by using DNS spoofing to "forward a connection" to a different https web site that has a valid certificate matching its own domain name, but not a certificate matching the domain name of the host requested by the user, aka "Windows HTTP Services Certificate Name Mismatch Vulnerability."

According to the version number obtained by NTLM the remote host has Windows Server 2008 installed. The host may be vulnerable to a number of vulnerabilities including remote unauthenticated code execution.

The version of Windows HTTP Services installed on the remote host is affected by several vulnerabilities :

  - An integer underflow triggered by a specially crafted     response from a malicious web server (for example,     during device discovery of UPnP devices on a network)     may allow for arbitrary code execution. (CVE-2009-0086)

  - Incomplete validation of the distinguished name in a     digital certificate may, in combination with other     attacks, allow an attacker to successfully spoof the     digital certificate of a third-party website.
    (CVE-2009-0089)

  - A flaw in the way that Windows HTTP Services handles     NTLM credentials may allow an attacker to reflect back     a user's credentials and thereby gain access as that     user. (CVE-2009-0550)

ID	Name	Product	Family	Severity
108811	Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)	Nessus	Windows	critical
36151	MS09-013: Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2009-0089

medium

Tenable Plugins

critical

high