| Package | Affected versions | Patched versions |
|---|---|---|
| access | = 2007 | |
| excel | = 2003= 2007 | |
| frontpage | = 2003 | |
| groove | = 2007 | |
| infopath | = 2003= 2007 | |
| office | = 2007 | |
| office communicator | = 2007 | |
| onenote | = 2003 | |
| outlook | = 2003= 2007 | |
| powerpoint | = 2003= 2007 | |
| project professional | = 2007 | |
| project standard | = 2007 | |
| publisher | = 2003= 2007 | |
| sharepoint designer | = 2007 | |
| visio professional | = 2007 | |
| visio standard | = 2007 | |
| windows live mail | = 2008 |
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free