CVE-2008-0082

An ActiveX control (Messenger.UIAutomation.1) in Windows Messenger 4.7 and 5.1 is marked as safe-for-scripting, which allows remote attackers to control the Messenger application, and "change state," obtain contact information, and establish audio or video connections without notification via unknown vectors.

Score

CVSS 2.0 10.0 Critical

Status

Modified - secure@microsoft.com

Published

2008-08-13

Last modified

2024-08-07

Weaknesses

CWE-200

Affected products

• Windows Messenger (Microsoft)

References

• http://marc.info/?l=bugtraq&m=121915960406986&w=2
• http://secunia.com/advisories/31446
• http://www.securityfocus.com/archive/1/495467/100/0/threaded
• http://www.securityfocus.com/bid/30551
• http://www.securitytracker.com/id?1020681
• http://www.us-cert.gov/cas/techalerts/TA08-225A.html
• http://www.vupen.com/english/advisories/2008/2354
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-050
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5995