Summaryinfo

A vulnerability was found in Microsoft Windows up to Vista and classified as critical. This vulnerability affects unknown code of the component Certificate Handler. The manipulation results in authentication spoofing. The attack can be launched remotely. No exploit exists. It is best practice to apply a patch to resolve this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows up to Vista (Operating System). It has been classified as critical. Affected is an unknown code of the component Certificate Handler. The manipulation with an unknown input leads to a authentication spoofing vulnerability. CWE is classifying the issue as CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. This is going to have an impact on integrity.

The weakness was disclosed 03/16/2015 as 3046310 as confirmed bulletin (Technet). The advisory is available at technet.microsoft.com. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at technet.microsoft.com.

The vulnerability is also documented in the vulnerability database at X-Force (101603). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7
• 8
• 8.1
• RT
• Server 2003
• Server 2008
• Server 2012
• Vista

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion