Unrated severityNVD Advisory· Published Dec 10, 2008· Updated Jun 16, 2026
CVE-2008-3009
CVE-2008-3009
Description
Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
13cpe:2.3:a:microsoft:windows_media_format_runtime:11:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:a:microsoft:windows_media_format_runtime:11:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:windows_media_format_runtime:11:*:x64:*:*:*:*:*
- cpe:2.3:a:microsoft:windows_media_format_runtime:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:windows_media_format_runtime:9:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:windows_media_format_runtime:9.5:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:windows_media_format_runtime:9.5:*:x64:*:*:*:*:*
- (no CPE)range: 7.1 through 11
cpe:2.3:a:microsoft:windows_media_player:6.4:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microsoft:windows_media_player:6.4:*:*:*:*:*:*:*
- (no CPE)range: 6.4
cpe:2.3:a:microsoft:windows_media_services:2008:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:microsoft:windows_media_services:2008:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:windows_media_services:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:windows_media_services:9:*:*:*:*:*:*:*
- (no CPE)range: 4.1, 9, and 2008
Patches
Vulnerability mechanics
References
8- www.us-cert.gov/cas/techalerts/TA08-344A.htmlnvdUS Government Resource
- secunia.com/advisories/33058nvd
- www.securityfocus.com/bid/32653nvd
- www.securitytracker.com/idnvd
- www.securitytracker.com/idnvd
- www.vupen.com/english/advisories/2008/3388nvd
- docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-076nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5942nvd
News mentions
0No linked articles in our index yet.