CVE-2008-3068: Microsoft Access

High severity, CVSS 7.5. EPSS: 17.4% chance of exploitation in the next 30 days.

Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.

Affected products

• Microsoft Access: version 2007 only
• Microsoft Excel: version 2003 only; version 2007 only
• Microsoft Frontpage: version 2003 only
• Microsoft Groove: version 2007 only
• Microsoft Infopath: version 2003 only; version 2007 only
• Microsoft Office: version 2007 only
• Microsoft Office Communicator: version 2007 only
• Microsoft Onenote: version 2003 only
• Microsoft Outlook: version 2003 only; version 2007 only
• Microsoft PowerPoint: version 2003 only; version 2007 only
• Microsoft Project Professional: version 2007 only
• Microsoft Project Standard: version 2007 only
• Microsoft Publisher: version 2003 only; version 2007 only
• Microsoft SharePoint Designer: version 2007 only
• Microsoft Visio Professional: version 2007 only
• Microsoft Visio Standard: version 2007 only
• Microsoft Windows Live Mail: version 2008 only

Published 2008-07-07. Last modified 2026-06-16.