Check Point Advisories

Protection against Microsoft Windows HTTP Services Certificate Name Mismatch Remote Code Execution Vulnerability (MS09-013)

Check Point Reference: SBP-2009-10
Date Published: 14 Apr 2009
Severity: High
Last Updated: Friday 17 April, 2009
Source: Microsoft Security Bulletin MS09-013
Industry Reference:CVE-2009-0089
Protection Provided by:
Who is Vulnerable? Microsoft Windows 2000 SP4
Windows XP SP2
Windows XP SP3
Windows XP Professional x64 Edition
Windows XP Professional x64 Edition SP2
Windows Server 2003 SP1
Windows Server 2003 SP2
Windows Server 2003 x64 Edition
Windows Server 2003 x64 Edition SP2
Windows Server 2003 with SP1 (Itanium)
Windows Server 2003 with SP2 (Itanium)
Windows Vista
Windows Vista SP1
Windows Vista x64 Edition
Windows Vista x64 Edition SP1
Windows Server 2008 for 32-bit Systems
Windows Server 2008 for x64-based Systems
Vulnerability Description A spoofing vulnerability has been reported in Microsoft Windows HTTP Services. Windows HTTP Services (WinHTTP) provides developers with an HTTP client application programming interface (API) to send requests through the HTTP protocol to other HTTP servers. A remote attacker may exploit this issue to impersonate a secure (HTTPS) web site.
Update/Patch AvaliableApply patches:
Microsoft Security Bulletin MS09-013
Vulnerability DetailsThe vulnerability is due to the WinHTTP incomplete validation of the distinguished name in a digital certificate. An attacker would need to combine this vulnerability with DNS spoofing to allow him to successfully spoof the digital certificate of a web site for any application that uses the Windows HTTP Services.

Protection Overview

This website uses cookies for its functionality and for analytics and marketing purposes. By continuing to use this website, you agree to the use of cookies. For more information, please read our Cookies Notice.