CVE-2007-5355: Medium severity Microsoft Windows 2000 vulnerability

Published Dec 5, 2007

Updated

The Web Proxy Auto-Discovery (WPAD) feature in Microsoft Internet Explorer 6 and 7, when a primary DNS suffix with three or more components is configured, resolves an unqualified wpad hostname in a second-level domain outside this configured DNS domain, which allows remote WPAD servers to conduct man-in-the-middle (MITM) attacks.

Affected Software

13 affected components

Microsoft Windows 2000=sp4

Microsoft Internet Explorer=5.01-sp4

Microsoft Internet Explorer=6-sp1

Microsoft Windows 2003 Server=64-bit

Microsoft Windows 2003 Server=64-bit_sp2

Microsoft Windows 2003 Server=itanium_sp1

Microsoft Windows 2003 Server=itanium_sp2

Microsoft Windows 2003 Server=sp1

Microsoft Windows 2003 Server=sp2

Microsoft Windows XP=sp2

Microsoft Internet Explorer=6

Microsoft Windows Vista

Microsoft Internet Explorer=7

Event History

Dec 5, 2007

CVE Published

11:46 AM

Data Sourced

11:46 AM

DescriptionWeaknessAffected Software

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5355?

CVE-2007-5355 has a moderate severity rating due to its potential for remote exploitation through misleading WPAD servers.

How do I fix CVE-2007-5355?

To fix CVE-2007-5355, users should install the latest security updates for Microsoft Internet Explorer and disable the Web Proxy Auto-Discovery feature.

Which versions of Internet Explorer are affected by CVE-2007-5355?

CVE-2007-5355 affects Internet Explorer 6 and 7, specifically their configurations with certain DNS suffixes.

Is CVE-2007-5355 applicable to Windows XP users?

CVE-2007-5355 does not affect Windows XP users as the vulnerable versions of Internet Explorer are not present.

Can CVE-2007-5355 be exploited remotely?

Yes, CVE-2007-5355 can be exploited remotely by attackers leveraging unqualified wpad hostnames in malicious WPAD servers.