Remote Information Disclosure in Microsoft Crypto API Used in Office and Outlook

CVE-2008-3068

Summary

The Microsoft Crypto API, utilized in Outlook, Windows Live Mail, and Office 2007, is susceptible to a vulnerability that allows remote attackers to exploit Certificate Revocation List (CRL) checks. By using a maliciously crafted certificate containing an Authority Information Access (AIA) extension, attackers can obtain sensitive information such as reading times, IP addresses of email recipients, and results of port scans. This highlights significant security concerns surrounding the handling of S/MIME email messages and digitally signed documents.

References