Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008; and WinINet in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008; allows remote web servers to capture and replay NTLM credentials, and execute arbitrary code, via vectors related to absence of a "credential-reflection protections" opt-in step, aka "Windows HTTP Services Credential Reflection Vulnerability" and "WinINet Credential Reflection Vulnerability."

According to the version number obtained by NTLM the remote host has Windows Server 2008 installed. The host may be vulnerable to a number of vulnerabilities including remote unauthenticated code execution.

The remote host is missing IE Security Update 963027.

The remote version of IE is affected by several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host.

The version of Windows HTTP Services installed on the remote host is affected by several vulnerabilities :

  - An integer underflow triggered by a specially crafted     response from a malicious web server (for example,     during device discovery of UPnP devices on a network)     may allow for arbitrary code execution. (CVE-2009-0086)

  - Incomplete validation of the distinguished name in a     digital certificate may, in combination with other     attacks, allow an attacker to successfully spoof the     digital certificate of a third-party website.
    (CVE-2009-0089)

  - A flaw in the way that Windows HTTP Services handles     NTLM credentials may allow an attacker to reflect back     a user's credentials and thereby gain access as that     user. (CVE-2009-0550)

ID	Name	Product	Family	Severity
108811	Windows Server 2008 Critical RCE Vulnerabilities (uncredentialed) (PCI/DSS)	Nessus	Windows	critical
36152	MS09-014: Cumulative Security Update for Internet Explorer (963027)	Nessus	Windows : Microsoft Bulletins	high
36151	MS09-013: Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2009-0550

critical

Tenable Plugins

critical

high

high