{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "203C193C-F044-4B1F-84E6-2AB332AF581B",
              "versionEndExcluding": "3.1.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A33FA7F-BB2A-4C66-B608-72997A2BD1DB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "31A64C69-D182-4BEC-BA8A-7B405F5B2FC0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B33C9BD-FC34-4DFC-A81F-C620D3DAA79D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7CAEEA81-5037-4B68-98D9-83AAEBC98E20",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_xp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B47EBFCC-1828-45AB-BC6D-FB980929A81A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X, and subsequently allows remote attackers to execute arbitrary code on Windows by leveraging an untrusted search path vulnerability in (a) Internet Explorer 7 on Windows XP or (b) the SearchPath function in Windows XP, Vista, and Server 2003 and 2008, aka a \"Carpet Bomb\" and a \"Blended Threat Elevation of Privilege Vulnerability,\" a different issue than CVE-2008-1032. NOTE: Apple considers this a vulnerability only because the Microsoft products can load application libraries from the desktop and, as of 20080619, has not covered the issue in an advisory for Mac OS X."
    },
    {
      "lang": "es",
      "value": "Apple Safari en Mac OS X y en versiones anteriores a 3.1.2 en Windows, no apunta al usuario despu\u00e9s de descargar un objeto que tiene un tipo de contenido no reconocido, lo que permite a atacantes remotos incluir malware dentro de (1) el directorio Desktop en Windows o (2) el directorio Downloads en Mac OS X, y posteriormente permite a atacantes remotos ejecutar c\u00f3digo arbitrario en Windows aprovechando una vulnerabilidad de ruta de b\u00fasqueda no confiable en (a) Internet Explorer 7 en Windows XP o (b) la funci\u00f3n SearchPath en Windows XP, Vista y Server 2003 y 2008, vulnerabilidad tambi\u00e9n conocida como \"Carpet Bomb\" y \"Blended Threat Elevation of Privilege Vulnerability\", un problema diferente de CVE-2008-1032. NOTA: Apple considera esto como vulnerabilidad solo porque los productos Microsoft pueden cargar bibliotecas de aplicaciones del escritorio y, como 20080619, no ha cubierto el problema en un aviso para Mac OS X."
    }
  ],
  "id": "CVE-2008-2540",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2008-06-03T15:32:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://blogs.zdnet.com/security/?p=1230"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://secunia.com/advisories/30467"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://securitytracker.com/id?1020150"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL\u0026id=871138"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.microsoft.com/technet/security/advisory/953818.mspx"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/29445"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id?1022047"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-104A.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.vupen.com/english/advisories/2008/1706"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1028"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1029"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-014"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-015"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42765"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5782"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6108"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8509"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://blogs.zdnet.com/security/?p=1230"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://secunia.com/advisories/30467"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://securitytracker.com/id?1020150"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL\u0026id=871138"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.microsoft.com/technet/security/advisory/953818.mspx"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/29445"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id?1022047"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-104A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.vupen.com/english/advisories/2008/1706"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1028"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1029"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-014"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-015"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42765"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5782"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6108"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8509"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Internet Explorer 7.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Internet Explorer 5.01 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Internet Explorer 6 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Internet\nExplorer et permettent \u00e0 une personne distante malintentionn\u00e9e\nd\u0027ex\u00e9cuter du code arbitraire :\n\n-   une erreur existe dans la fonction de localisation et d\u0027ouverture\n    des fichiers sur le syst\u00e8me (CVE-2008-2540) ;\n-   une erreur existe dans le traitement des informations\n    d\u0027identification NTLM par WinINet lorsque celles-ci sont envoy\u00e9es\n    via HTTP (CVE-2009-0550) ;\n-   une corruption m\u00e9moire existe dans la mani\u00e8re dont Microsoft\n    Internet Explorer traite les transitions entre pages web\n    (CVE-2009-0551) ;\n-   plusieurs erreurs existent dans la mani\u00e8re dont Microsoft Internet\n    Explorer acc\u00e8de \u00e0 un objet mal initialis\u00e9 ou supprim\u00e9\n    (CVE-2009-0552, CVE-2009-0553 et CVE-2009-0554) ;\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 MS09-014 de Microsoft pour\nl\u0027obtention des correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-2540",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-2540"
    },
    {
      "name": "CVE-2009-0553",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0553"
    },
    {
      "name": "CVE-2009-0551",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0551"
    },
    {
      "name": "CVE-2009-0550",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0550"
    },
    {
      "name": "CVE-2009-0552",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0552"
    },
    {
      "name": "CVE-2009-0554",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0554"
    }
  ],
  "initial_release_date": "2009-04-15T00:00:00",
  "last_revision_date": "2009-04-15T00:00:00",
  "links": [],
  "reference": "CERTA-2009-AVI-144",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-04-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s affectent Microsoft Internet Explorer et\npermettent \u00e0 une personne malintentionn\u00e9e d\u0027ex\u00e9cuter du code arbitraire\n\u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Internet Explorer",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS09-014 du 14 avril 2009",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS09-014.mspx"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eToutes les versions support\u00e9es des  syst\u00e8mes suivants sont affect\u00e9es :  \u003cUL\u003e    \u003cLI\u003eWindows XP ;\u003c/LI\u003e    \u003cLI\u003eWindows Server 2003 ;\u003c/LI\u003e    \u003cLI\u003eWindows Vista ;\u003c/LI\u003e    \u003cLI\u003eWindows Server 2008.\u003c/LI\u003e  \u003c/UL\u003e\u003c/p\u003e",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 affectant la fonction SearchPath permet \u00e0 un individu\nmalveillant d\u0027\u00e9lever ses privil\u00e8ges au moyen d\u0027un fichier sp\u00e9cifiquement\nconstruit.\n\nLa fonction SearchPath est utilis\u00e9e pour ouvrir et conna\u00eetre\nl\u0027emplacement des fichiers sur le syst\u00e8me.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-2540",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-2540"
    }
  ],
  "initial_release_date": "2009-04-15T00:00:00",
  "last_revision_date": "2009-04-15T00:00:00",
  "links": [],
  "reference": "CERTA-2009-AVI-145",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-04-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 de \u003cspan class=\"textit\"\u003eMicrosoft Windows\u003c/span\u003e\npermet \u00e0 un individu malveillant d\u0027\u00e9lever ses privil\u00e8ges.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS09-015 du 14 avril 2009",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS09-015.mspx"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-2540"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-06-03T15:32:00Z",
    "severity": "HIGH"
  },
  "details": "Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X, and subsequently allows remote attackers to execute arbitrary code on Windows by leveraging an untrusted search path vulnerability in (a) Internet Explorer 7 on Windows XP or (b) the SearchPath function in Windows XP, Vista, and Server 2003 and 2008, aka a \"Carpet Bomb\" and a \"Blended Threat Elevation of Privilege Vulnerability,\" a different issue than CVE-2008-1032. NOTE: Apple considers this a vulnerability only because the Microsoft products can load application libraries from the desktop and, as of 20080619, has not covered the issue in an advisory for Mac OS X.",
  "id": "GHSA-6mfp-r743-cc3p",
  "modified": "2022-05-01T23:50:53Z",
  "published": "2022-05-01T23:50:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-2540"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-014"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-015"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42765"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5782"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6108"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8509"
    },
    {
      "type": "WEB",
      "url": "http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx"
    },
    {
      "type": "WEB",
      "url": "http://blogs.zdnet.com/security/?p=1230"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30467"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1020150"
    },
    {
      "type": "WEB",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm"
    },
    {
      "type": "WEB",
      "url": "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL\u0026id=871138"
    },
    {
      "type": "WEB",
      "url": "http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html"
    },
    {
      "type": "WEB",
      "url": "http://www.microsoft.com/technet/security/advisory/953818.mspx"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/29445"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1022047"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-104A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/1706"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2009/1028"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2009/1029"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "GSD": {
    "alias": "CVE-2008-2540",
    "description": "Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X, and subsequently allows remote attackers to execute arbitrary code on Windows by leveraging an untrusted search path vulnerability in (a) Internet Explorer 7 on Windows XP or (b) the SearchPath function in Windows XP, Vista, and Server 2003 and 2008, aka a \"Carpet Bomb\" and a \"Blended Threat Elevation of Privilege Vulnerability,\" a different issue than CVE-2008-1032. NOTE: Apple considers this a vulnerability only because the Microsoft products can load application libraries from the desktop and, as of 20080619, has not covered the issue in an advisory for Mac OS X.",
    "id": "GSD-2008-2540"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2008-2540"
      ],
      "details": "Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X, and subsequently allows remote attackers to execute arbitrary code on Windows by leveraging an untrusted search path vulnerability in (a) Internet Explorer 7 on Windows XP or (b) the SearchPath function in Windows XP, Vista, and Server 2003 and 2008, aka a \"Carpet Bomb\" and a \"Blended Threat Elevation of Privilege Vulnerability,\" a different issue than CVE-2008-1032. NOTE: Apple considers this a vulnerability only because the Microsoft products can load application libraries from the desktop and, as of 20080619, has not covered the issue in an advisory for Mac OS X.",
      "id": "GSD-2008-2540",
      "modified": "2023-12-13T01:23:01.127391Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2008-2540",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X, and subsequently allows remote attackers to execute arbitrary code on Windows by leveraging an untrusted search path vulnerability in (a) Internet Explorer 7 on Windows XP or (b) the SearchPath function in Windows XP, Vista, and Server 2003 and 2008, aka a \"Carpet Bomb\" and a \"Blended Threat Elevation of Privilege Vulnerability,\" a different issue than CVE-2008-1032. NOTE: Apple considers this a vulnerability only because the Microsoft products can load application libraries from the desktop and, as of 20080619, has not covered the issue in an advisory for Mac OS X."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "30467",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/30467"
          },
          {
            "name": "ADV-2009-1028",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/1028"
          },
          {
            "name": "1022047",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id?1022047"
          },
          {
            "name": "1020150",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1020150"
          },
          {
            "name": "29445",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/29445"
          },
          {
            "name": "http://www.microsoft.com/technet/security/advisory/953818.mspx",
            "refsource": "MISC",
            "url": "http://www.microsoft.com/technet/security/advisory/953818.mspx"
          },
          {
            "name": "ADV-2009-1029",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/1029"
          },
          {
            "name": "TA09-104A",
            "refsource": "CERT",
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-104A.html"
          },
          {
            "name": "oval:org.mitre.oval:def:8509",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8509"
          },
          {
            "name": "http://blogs.zdnet.com/security/?p=1230",
            "refsource": "MISC",
            "url": "http://blogs.zdnet.com/security/?p=1230"
          },
          {
            "name": "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL\u0026id=871138",
            "refsource": "CONFIRM",
            "url": "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL\u0026id=871138"
          },
          {
            "name": "MS09-014",
            "refsource": "MS",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-014"
          },
          {
            "name": "http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html",
            "refsource": "MISC",
            "url": "http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html"
          },
          {
            "name": "APPLE-SA-2008-06-19",
            "refsource": "APPLE",
            "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html"
          },
          {
            "name": "http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx",
            "refsource": "MISC",
            "url": "http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx"
          },
          {
            "name": "oval:org.mitre.oval:def:5782",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5782"
          },
          {
            "name": "apple-safari-windows-code-execution(42765)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42765"
          },
          {
            "name": "MS09-015",
            "refsource": "MS",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-015"
          },
          {
            "name": "oval:org.mitre.oval:def:6108",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6108"
          },
          {
            "name": "http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm",
            "refsource": "CONFIRM",
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm"
          },
          {
            "name": "ADV-2008-1706",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2008/1706"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "3.1.2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_xp:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-2540"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X, and subsequently allows remote attackers to execute arbitrary code on Windows by leveraging an untrusted search path vulnerability in (a) Internet Explorer 7 on Windows XP or (b) the SearchPath function in Windows XP, Vista, and Server 2003 and 2008, aka a \"Carpet Bomb\" and a \"Blended Threat Elevation of Privilege Vulnerability,\" a different issue than CVE-2008-1032. NOTE: Apple considers this a vulnerability only because the Microsoft products can load application libraries from the desktop and, as of 20080619, has not covered the issue in an advisory for Mac OS X."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-264"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx"
            },
            {
              "name": "http://blogs.zdnet.com/security/?p=1230",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://blogs.zdnet.com/security/?p=1230"
            },
            {
              "name": "http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html",
              "refsource": "MISC",
              "tags": [
                "Broken Link"
              ],
              "url": "http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html"
            },
            {
              "name": "http://www.microsoft.com/technet/security/advisory/953818.mspx",
              "refsource": "MISC",
              "tags": [
                "Mitigation",
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.microsoft.com/technet/security/advisory/953818.mspx"
            },
            {
              "name": "29445",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/29445"
            },
            {
              "name": "1020150",
              "refsource": "SECTRACK",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://securitytracker.com/id?1020150"
            },
            {
              "name": "30467",
              "refsource": "SECUNIA",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://secunia.com/advisories/30467"
            },
            {
              "name": "APPLE-SA-2008-06-19",
              "refsource": "APPLE",
              "tags": [
                "Mailing List",
                "Vendor Advisory"
              ],
              "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html"
            },
            {
              "name": "ADV-2009-1028",
              "refsource": "VUPEN",
              "tags": [
                "Broken Link"
              ],
              "url": "http://www.vupen.com/english/advisories/2009/1028"
            },
            {
              "name": "ADV-2009-1029",
              "refsource": "VUPEN",
              "tags": [
                "Broken Link"
              ],
              "url": "http://www.vupen.com/english/advisories/2009/1029"
            },
            {
              "name": "1022047",
              "refsource": "SECTRACK",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securitytracker.com/id?1022047"
            },
            {
              "name": "TA09-104A",
              "refsource": "CERT",
              "tags": [
                "Third Party Advisory",
                "US Government Resource"
              ],
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-104A.html"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm"
            },
            {
              "name": "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL\u0026id=871138",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL\u0026id=871138"
            },
            {
              "name": "ADV-2008-1706",
              "refsource": "VUPEN",
              "tags": [
                "Broken Link"
              ],
              "url": "http://www.vupen.com/english/advisories/2008/1706"
            },
            {
              "name": "apple-safari-windows-code-execution(42765)",
              "refsource": "XF",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42765"
            },
            {
              "name": "oval:org.mitre.oval:def:8509",
              "refsource": "OVAL",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8509"
            },
            {
              "name": "oval:org.mitre.oval:def:6108",
              "refsource": "OVAL",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6108"
            },
            {
              "name": "oval:org.mitre.oval:def:5782",
              "refsource": "OVAL",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5782"
            },
            {
              "name": "MS09-015",
              "refsource": "MS",
              "tags": [],
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-015"
            },
            {
              "name": "MS09-014",
              "refsource": "MS",
              "tags": [],
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-014"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 10.0,
          "obtainAllPrivilege": true,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2019-02-26T14:04Z",
      "publishedDate": "2008-06-03T15:32Z"
    }
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200806-0058",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "safari",
        "scope": "lt",
        "trust": 1.8,
        "vendor": "apple",
        "version": "3.1.2"
      },
      {
        "model": "safari",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "apple",
        "version": "3.1.1"
      },
      {
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "6"
      },
      {
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "7"
      },
      {
        "model": "windows server 2003",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "none"
      },
      {
        "model": "windows server 2003",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "(itanium)"
      },
      {
        "model": "windows server 2003",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "(x64)"
      },
      {
        "model": "windows server 2008",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "(itanium)"
      },
      {
        "model": "windows server 2008",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "(x64)"
      },
      {
        "model": "windows server 2008",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "(x86)"
      },
      {
        "model": "windows vista",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "none"
      },
      {
        "model": "windows vista",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "(x64)"
      },
      {
        "model": "windows xp",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "(x64)"
      },
      {
        "model": "windows xp",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "sp3"
      },
      {
        "model": "safari",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "3.0.4"
      },
      {
        "model": "safari",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "3.1.1b"
      },
      {
        "model": "safari",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "3.1.0"
      },
      {
        "model": "safari",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "3.0.4b"
      },
      {
        "model": "safari",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "3.1.0b"
      },
      {
        "model": "windows xp home sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows vista business 64-bit edition sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows vista edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "x640"
      },
      {
        "model": "networks contact center express",
        "scope": null,
        "trust": 0.3,
        "vendor": "nortel",
        "version": null
      },
      {
        "model": "windows server enterprise edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20080"
      },
      {
        "model": "windows vista business 64-bit edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "0"
      },
      {
        "model": "windows professional sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "networks contact center",
        "scope": null,
        "trust": 0.3,
        "vendor": "nortel",
        "version": null
      },
      {
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.1"
      },
      {
        "model": "windows vista enterprise 64-bit edition sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "networks callpilot 1002rp",
        "scope": null,
        "trust": 0.3,
        "vendor": "nortel",
        "version": null
      },
      {
        "model": "windows xp professional",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server enterprise edition sp1 beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20031"
      },
      {
        "model": "windows advanced server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows xp media center edition sp3",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server enterprise edition itanium",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20030"
      },
      {
        "model": "windows xp tablet pc edition sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows vista home basic",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.4"
      },
      {
        "model": "windows xp professional edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "x64"
      },
      {
        "model": "windows xp tablet pc edition",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "networks callpilot 1005r",
        "scope": null,
        "trust": 0.3,
        "vendor": "nortel",
        "version": null
      },
      {
        "model": "windows server enterprise edition sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows vista sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.2"
      },
      {
        "model": "windows server for 32-bit systems",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20080"
      },
      {
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "7.0"
      },
      {
        "model": "windows xp professional edition sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "x64"
      },
      {
        "model": "windows xp 64-bit edition",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server enterprise edition sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003x64"
      },
      {
        "model": "windows server web edition sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows server enterprise edition itanium sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "networks callpilot 600r",
        "scope": null,
        "trust": 0.3,
        "vendor": "nortel",
        "version": null
      },
      {
        "model": "windows server standard edition sp1 beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20031"
      },
      {
        "model": "windows server sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "messaging application server mm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "3.0"
      },
      {
        "model": "messaging application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "0"
      },
      {
        "model": "windows server standard edition sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows xp media center edition",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows xp tablet pc edition sp3",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows xp media center edition sp2",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1"
      },
      {
        "model": "windows vista",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "0"
      },
      {
        "model": "windows vista home premium sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003x64"
      },
      {
        "model": "safari for windows",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1.2"
      },
      {
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1"
      },
      {
        "model": "windows xp professional sp3",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server datacenter edition itanium",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20030"
      },
      {
        "model": "messaging application server mm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "3.1"
      },
      {
        "model": "windows vista home premium 64-bit edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "0"
      },
      {
        "model": "windows vista ultimate 64-bit edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "0"
      },
      {
        "model": "networks contact center manager",
        "scope": null,
        "trust": 0.3,
        "vendor": "nortel",
        "version": null
      },
      {
        "model": "windows server datacenter edition sp1 beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20031"
      },
      {
        "model": "windows vista enterprise 64-bit edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "0"
      },
      {
        "model": "windows server enterprise edition release candidate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2008"
      },
      {
        "model": "windows datacenter server sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows server web edition sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows server standard edition release candidate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2008"
      },
      {
        "model": "windows xp tablet pc edition sp2",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server enterprise edition itanium sp1 beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20031"
      },
      {
        "model": "windows server sp4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows advanced server sp4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows advanced server sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "messaging application server mm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "2.0"
      },
      {
        "model": "windows server sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003x64"
      },
      {
        "model": "windows vista edition sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "x64"
      },
      {
        "model": "windows vista home basic 64-bit edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "0"
      },
      {
        "model": "windows server datacenter edition itanium sp1 beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20031"
      },
      {
        "model": "networks contact center multimedia",
        "scope": null,
        "trust": 0.3,
        "vendor": "nortel",
        "version": null
      },
      {
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1.1"
      },
      {
        "model": "windows server datacenter edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows datacenter server sp4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows vista home basic 64-bit edition sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows datacenter server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows xp professional sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows professional sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows vista enterprise",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows xp professional edition sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "x64"
      },
      {
        "model": "networks contact center manager server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nortel",
        "version": "0"
      },
      {
        "model": "windows server standard edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows vista ultimate sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server itanium sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows server sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows server datacenter edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20080"
      },
      {
        "model": "windows vista home premium 64-bit edition sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server enterprise edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003x64"
      },
      {
        "model": "windows advanced server sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows vista business sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server standard edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20080"
      },
      {
        "model": "messaging application server mm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "1.1"
      },
      {
        "model": "windows vista ultimate",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server standard edition sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "networks callpilot 703t",
        "scope": null,
        "trust": 0.3,
        "vendor": "nortel",
        "version": null
      },
      {
        "model": "networks callpilot 201i",
        "scope": null,
        "trust": 0.3,
        "vendor": "nortel",
        "version": null
      },
      {
        "model": "windows datacenter server sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows xp home",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows vista home premium",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server web edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows professional sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows server sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3"
      },
      {
        "model": "windows xp media center edition sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows advanced server sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows professional sp4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows server for itanium-based systems",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20080"
      },
      {
        "model": "windows vista business",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server itanium",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20030"
      },
      {
        "model": "windows xp professional sp2",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows xp home sp2",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.3"
      },
      {
        "model": "windows vista home basic sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows xp 64-bit edition sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server for x64-based systems",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20080"
      },
      {
        "model": "windows xp 64-bit edition version sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows vista ultimate 64-bit edition sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server datacenter edition release candidate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2008"
      },
      {
        "model": "windows server itanium sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows server datacenter edition sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows datacenter server sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows xp home sp3",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "windows vista enterprise sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "windows server enterprise edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows xp 64-bit edition version",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows server datacenter edition itanium sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2003"
      },
      {
        "model": "windows server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "2000"
      },
      {
        "model": "networks contact center administration",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nortel",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "29445"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200806-055"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-2540"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:apple:safari",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:microsoft:internet_explorer",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:microsoft:windows_server_2003",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:microsoft:windows_server_2008",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:microsoft:windows_vista",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:microsoft:windows_xp",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Nitesh Dhanjani",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200806-055"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2008-2540",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2008-2540",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.6,
            "id": "VHN-32665",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2008-2540",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2008-2540",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200806-055",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-32665",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-32665"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200806-055"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-2540"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X, and subsequently allows remote attackers to execute arbitrary code on Windows by leveraging an untrusted search path vulnerability in (a) Internet Explorer 7 on Windows XP or (b) the SearchPath function in Windows XP, Vista, and Server 2003 and 2008, aka a \"Carpet Bomb\" and a \"Blended Threat Elevation of Privilege Vulnerability,\" a different issue than CVE-2008-1032. NOTE: Apple considers this a vulnerability only because the Microsoft products can load application libraries from the desktop and, as of 20080619, has not covered the issue in an advisory for Mac OS X. A vulnerability in Apple Safari on the Microsoft Windows operating system stems from a combination of security issues in Safari and all versions of Windows XP and Vista that will allow executables to be downloaded to a user\u0027s computer and run without prompting. \nA vulnerability in Safari, known as the \u0027carpet-bombing\u0027 issue reported by Nitesh Dhanjani, allows an attacker to silently place malicious DLL files on a victim\u0027s computer. A problem in Internet Explorer, reported in December of 2006 by Aviv Raff, can then be used to run those malicious DLLs. \nAn attacker can exploit this issue by tricking a victim into visiting a malicious page with Safari; the malicious files will run when the victim starts Internet Explorer. \n\nSuccessful exploitation allows execution of arbitrary code when a\nuser visits a malicious web site. \n\nSOLUTION:\nSet the download location in Safari to a location other than\n\"Desktop\". \n\nORIGINAL ADVISORY:\nhttp://www.microsoft.com/technet/security/advisory/953818.mspx\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n\n                    National Cyber Alert System\n\n              Technical Cyber Security Alert TA09-104A\n\n\nMicrosoft Updates for Multiple Vulnerabilities\n\n   Original release date: April 14, 2009\n   Last revised: --\n   Source: US-CERT\n\n\nSystems Affected\n\n     * Microsoft Windows\n     * Microsoft Office\n     * Microsoft Windows Server\n     * Microsoft ISA Server\n\n\nOverview\n\n   Microsoft has released updates that address vulnerabilities in\n   Microsoft Windows, Office, Windows Server, and ISA Server. \n\n\nI. Description\n\n   As part of the Microsoft Security Bulletin Summary for April 2009,\n   Microsoft released updates to address vulnerabilities that affect\n   Microsoft Windows, Office, Windows Server, and ISA Server. \n\n\nII. Impact\n\n   A remote, unauthenticated attacker could execute arbitrary code,\n   gain elevated privileges,  or cause a vulnerable application to\n   crash. \n\n\nIII. Solution\n\n   Microsoft has provided updates for these vulnerabilities in the\n   Microsoft Security Bulletin Summary for April 2009. The security\n   bulletin describes any known issues related to the updates. \n   Administrators are encouraged to note these issues and test for any\n   potentially adverse effects. Administrators should consider using\n   an automated update distribution system such as Windows Server\n   Update Services (WSUS). \n\n\nIV. References\n\n * Microsoft Security Bulletin Summary for April 2009 -\n   \u003chttp://www.microsoft.com/technet/security/bulletin/ms09-apr.mspx\u003e\n\n * Microsoft Windows Server Update Services -\n   \u003chttp://technet.microsoft.com/en-us/wsus/default.aspx\u003e\n\n ____________________________________________________________________\n\n   The most recent version of this document can be found at:\n\n     \u003chttp://www.us-cert.gov/cas/techalerts/TA09-104A.html\u003e\n ____________________________________________________________________\n\n   Feedback can be directed to US-CERT Technical Staff. Please send\n   email to \u003ccert@cert.org\u003e with \"TA09-104A Feedback VU#999892\" in\n   the subject. \n ____________________________________________________________________\n\n   For instructions on subscribing to or unsubscribing from this\n   mailing list, visit \u003chttp://www.us-cert.gov/cas/signup.html\u003e. \n ____________________________________________________________________\n\n   Produced 2009 by US-CERT, a government organization. \n\n   Terms of use:\n\n     \u003chttp://www.us-cert.gov/legal.html\u003e\n ____________________________________________________________________\n\nRevision History\n  \n  April 14, 2009: Initial release\n\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.5 (GNU/Linux)\n\niQEVAwUBSeTi+XIHljM+H4irAQIIWQf/TWAkmQKay9j5fDLBcyMGJ3icTpG05Zp2\nrM8UXMjKohKcDBhY1K9mxKxif5L81+y87PlBz/WTl3icn+57wAGMl/pAAeTz3Hp3\nT98eKMXfzvVU57WDGGxy+4Ad57DIIF5hRkiGusDjnNJfd5kdH7q+8rPjPCUvtYAu\nH+0auzCpmob7NsIv/YuRXIHekkLiX5GPanhecy+mve1cvbSpXGKF9vf7LEGaFEsT\n1XOtTeY0r4TjZEk/c5ahKqGehJINujvv4eVdiajqDOCVecaALi+p+XwMSLtlJvgK\nVaa/ioPIFq8nNUz7eefVSadsary2RfmKegDwmg8FZX/UOso+tQ21KQ==\n=q59/\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2008-2540"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      },
      {
        "db": "BID",
        "id": "29445"
      },
      {
        "db": "VULHUB",
        "id": "VHN-32665"
      },
      {
        "db": "PACKETSTORM",
        "id": "66926"
      },
      {
        "db": "PACKETSTORM",
        "id": "76655"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2008-2540",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "29445",
        "trust": 2.8
      },
      {
        "db": "USCERT",
        "id": "TA09-104A",
        "trust": 2.6
      },
      {
        "db": "SECTRACK",
        "id": "1020150",
        "trust": 2.5
      },
      {
        "db": "SECUNIA",
        "id": "30467",
        "trust": 1.8
      },
      {
        "db": "SECTRACK",
        "id": "1022047",
        "trust": 1.7
      },
      {
        "db": "VUPEN",
        "id": "ADV-2009-1029",
        "trust": 1.7
      },
      {
        "db": "VUPEN",
        "id": "ADV-2008-1706",
        "trust": 1.7
      },
      {
        "db": "VUPEN",
        "id": "ADV-2009-1028",
        "trust": 1.7
      },
      {
        "db": "XF",
        "id": "42765",
        "trust": 1.4
      },
      {
        "db": "USCERT",
        "id": "SA09-104A",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001419",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200806-055",
        "trust": 0.7
      },
      {
        "db": "MS",
        "id": "MS09-015",
        "trust": 0.6
      },
      {
        "db": "CERT/CC",
        "id": "TA09-104A",
        "trust": 0.6
      },
      {
        "db": "APPLE",
        "id": "APPLE-SA-2008-06-19",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-32665",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "66926",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "76655",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-32665"
      },
      {
        "db": "BID",
        "id": "29445"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      },
      {
        "db": "PACKETSTORM",
        "id": "66926"
      },
      {
        "db": "PACKETSTORM",
        "id": "76655"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200806-055"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-2540"
      }
    ]
  },
  "id": "VAR-200806-0058",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-32665"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T19:42:02.923000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Safari 3.1.2",
        "trust": 0.8,
        "url": "http://support.apple.com/kb/HT2092"
      },
      {
        "title": "Safari 3.1.2",
        "trust": 0.8,
        "url": "http://support.apple.com/kb/HT2092?locale=ja_JP"
      },
      {
        "title": "953818",
        "trust": 0.8,
        "url": "http://www.microsoft.com/technet/security/advisory/953818.mspx"
      },
      {
        "title": "MS09-014",
        "trust": 0.8,
        "url": "http://www.microsoft.com/technet/security/bulletin/MS09-014.mspx"
      },
      {
        "title": "MS09-015",
        "trust": 0.8,
        "url": "http://www.microsoft.com/technet/security/bulletin/MS09-015.mspx"
      },
      {
        "title": "953818",
        "trust": 0.8,
        "url": "http://www.microsoft.com/japan/technet/security/advisory/953818.mspx"
      },
      {
        "title": "MS09-014",
        "trust": 0.8,
        "url": "http://www.microsoft.com/japan/technet/security/bulletin/MS09-014.mspx"
      },
      {
        "title": "MS09-015",
        "trust": 0.8,
        "url": "http://www.microsoft.com/japan/technet/security/bulletin/MS09-015.mspx"
      },
      {
        "title": "MS09-015e",
        "trust": 0.8,
        "url": "http://www.microsoft.com/japan/security/bulletins/MS09-015e.mspx"
      },
      {
        "title": "MS09-014e",
        "trust": 0.8,
        "url": "http://www.microsoft.com/japan/security/bulletins/MS09-014e.mspx"
      },
      {
        "title": "TA09-104A",
        "trust": 0.8,
        "url": "http://software.fujitsu.com/jp/security/vulnerabilities/ta09-104a.html"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-264",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-32665"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-2540"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "http://www.securityfocus.com/bid/29445"
      },
      {
        "trust": 2.5,
        "url": "http://www.us-cert.gov/cas/techalerts/ta09-104a.html"
      },
      {
        "trust": 2.5,
        "url": "http://securitytracker.com/id?1020150"
      },
      {
        "trust": 2.1,
        "url": "http://www.microsoft.com/technet/security/advisory/953818.mspx"
      },
      {
        "trust": 2.0,
        "url": "http://support.avaya.com/elmodocs2/security/asa-2009-133.htm"
      },
      {
        "trust": 2.0,
        "url": "http://aviv.raffon.net/2008/05/31/safaripwnsinternetexplorer.aspx"
      },
      {
        "trust": 2.0,
        "url": "http://blogs.zdnet.com/security/?p=1230"
      },
      {
        "trust": 2.0,
        "url": "http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html"
      },
      {
        "trust": 1.9,
        "url": "http://support.nortel.com/go/main.jsp?cscat=bltndetail\u0026id=871138"
      },
      {
        "trust": 1.7,
        "url": "http://lists.apple.com/archives/security-announce/2008//jun/msg00001.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id?1022047"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/30467"
      },
      {
        "trust": 1.7,
        "url": "http://www.vupen.com/english/advisories/2009/1028"
      },
      {
        "trust": 1.7,
        "url": "http://www.vupen.com/english/advisories/2009/1029"
      },
      {
        "trust": 1.4,
        "url": "http://www.frsirt.com/english/advisories/2008/1706"
      },
      {
        "trust": 1.4,
        "url": "http://xforce.iss.net/xforce/xfdb/42765"
      },
      {
        "trust": 1.1,
        "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-014"
      },
      {
        "trust": 1.1,
        "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-015"
      },
      {
        "trust": 1.1,
        "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a5782"
      },
      {
        "trust": 1.1,
        "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a6108"
      },
      {
        "trust": 1.1,
        "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a8509"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2008/1706"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42765"
      },
      {
        "trust": 0.9,
        "url": "http://www.microsoft.com/technet/security/bulletin/ms09-015.mspx"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-2540"
      },
      {
        "trust": 0.8,
        "url": "http://www.jpcert.or.jp/at/2009/at090007.txt"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnta09-104a/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-2540"
      },
      {
        "trust": 0.8,
        "url": "http://www.us-cert.gov/cas/alerts/sa09-104a.html"
      },
      {
        "trust": 0.8,
        "url": "http://www.cyberpolice.go.jp/#topics"
      },
      {
        "trust": 0.3,
        "url": "http://blogs.technet.com/srd/archive/2009/04/14/ms09-014-addressing-the-safari-carpet-bomb-vulnerability.aspx"
      },
      {
        "trust": 0.3,
        "url": "http://support.avaya.com/elmodocs2/security/asa-2009-138.htm"
      },
      {
        "trust": 0.3,
        "url": "http://www.microsoft.com/technet/security/bulletin/ms09-014.mspx"
      },
      {
        "trust": 0.1,
        "url": "http://support.nortel.com/go/main.jsp?cscat=bltndetail\u0026amp;id=871138"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/22/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/30467/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/16/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/13223/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_specialist/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/17978/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://www.us-cert.gov/cas/techalerts/ta09-104a.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.microsoft.com/technet/security/bulletin/ms09-apr.mspx\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.us-cert.gov/cas/signup.html\u003e."
      },
      {
        "trust": 0.1,
        "url": "http://www.us-cert.gov/legal.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://technet.microsoft.com/en-us/wsus/default.aspx\u003e"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-32665"
      },
      {
        "db": "BID",
        "id": "29445"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      },
      {
        "db": "PACKETSTORM",
        "id": "66926"
      },
      {
        "db": "PACKETSTORM",
        "id": "76655"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200806-055"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-2540"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-32665"
      },
      {
        "db": "BID",
        "id": "29445"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      },
      {
        "db": "PACKETSTORM",
        "id": "66926"
      },
      {
        "db": "PACKETSTORM",
        "id": "76655"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200806-055"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-2540"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2008-06-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-32665"
      },
      {
        "date": "2008-05-30T00:00:00",
        "db": "BID",
        "id": "29445"
      },
      {
        "date": "2008-06-27T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      },
      {
        "date": "2008-06-03T18:08:05",
        "db": "PACKETSTORM",
        "id": "66926"
      },
      {
        "date": "2009-04-15T00:10:24",
        "db": "PACKETSTORM",
        "id": "76655"
      },
      {
        "date": "2008-05-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200806-055"
      },
      {
        "date": "2008-06-03T15:32:00",
        "db": "NVD",
        "id": "CVE-2008-2540"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-10-12T00:00:00",
        "db": "VULHUB",
        "id": "VHN-32665"
      },
      {
        "date": "2009-04-20T22:46:00",
        "db": "BID",
        "id": "29445"
      },
      {
        "date": "2009-05-15T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      },
      {
        "date": "2011-07-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200806-055"
      },
      {
        "date": "2024-11-21T00:47:06.657000",
        "db": "NVD",
        "id": "CVE-2008-2540"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200806-055"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apple Safari In Vulnerabilities that do not warn before downloading",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001419"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200806-055"
      }
    ],
    "trust": 0.6
  }
}