Published: 15/04/2009 Updated: 07/12/2023

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P

Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Vista Gold allows remote web servers to impersonate arbitrary https web sites by using DNS spoofing to "forward a connection" to a different https web site that has a valid certificate matching its own domain name, but not a certificate matching the domain name of the host requested by the user, aka "Windows HTTP Services Certificate Name Mismatch Vulnerability."

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft windows xp
microsoft windows vista
microsoft windows 2000
microsoft windows server 2003
microsoft windows server 2008

CWE-20 http://www.securityfocus.com/bid/34437 http://www.us-cert.gov/cas/techalerts/TA09-104A.html http://www.securitytracker.com/id?1022041 http://www.vupen.com/english/advisories/2009/1027 http://secunia.com/advisories/34677 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6027 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-013 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2009-0089

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect