CVE-2008-3068

CVE-2008-3068 is a high-severity vulnerability in Microsoft Access with a CVSS 2.0 base score of 7.5. Its EPSS exploit-prediction score of 17% places it in the 97th percentile, indicating an elevated likelihood of exploitation.

Key facts

• Severity: High (CVSS 2.0 base score 7.5)
• EPSS exploit prediction: 17% (97th percentile)
• Actively exploited: Not listed in CISA KEV
• Affected product: Microsoft Access
• Published: 2008-07-07
• Last modified: 2026-06-16

Description

Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.

Frequently asked questions

What is CVE-2008-3068?

Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.

How severe is CVE-2008-3068?

CVE-2008-3068 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2008-3068 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 17% (97th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2008-3068?

CVE-2008-3068 primarily affects Microsoft Access. In total, 23 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2008-3068?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2008-3068 published?

CVE-2008-3068 was published on 2008-07-07 and last updated on 2026-06-16.

References

• http://securityreason.com/securityalert/3978
• http://www.securityfocus.com/archive/1/493947/100/0/threaded
• http://www.securityfocus.com/archive/1/494101/100/0/threaded
• http://www.securityfocus.com/bid/28548
• http://www.securitytracker.com/id?1019736
• http://www.securitytracker.com/id?1019737
• http://www.securitytracker.com/id?1019738
• https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt
• https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt
• https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt
• https://www.cynops.de/techzone/http_over_x509.html
• https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt
• https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt
• https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt

Affected products (23)

• cpe:2.3:a:microsoft:access:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:excel:2003:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:excel:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:frontpage:2003:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:groove:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:infopath:2003:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:infopath:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:office:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:*
• cpe:2.3:a:microsoft:office_communicator:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:onenote:2003:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:outlook:2003:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:outlook:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:powerpoint:2003:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:powerpoint:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:project_professional:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:project_standard:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:publisher:2003:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:publisher:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:sharepoint_designer:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:visio_professional:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:visio_standard:2007:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:windows_live_mail:2008:*:*:*:*:*:*:*

More vulnerabilities in Microsoft Access

• CVE-2000-0788 — Critical (CVSS 10.0): The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic (VBA) scripts in an Access…
• CVE-1999-0364 — Critical (CVSS 10.0): Microsoft Access 97 stores a database password as plaintext in a foreign mdb, allowing access to data.
• CVE-2015-2503 — Critical (CVSS 9.3): Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3,…
• CVE-2013-3157 — Critical (CVSS 9.3): Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary…
• CVE-2013-3156 — Critical (CVSS 9.3): Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary…
• CVE-2013-3155 — Critical (CVSS 9.3): Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary…

All CVEs affecting Microsoft Access →