{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Windows 2000 Server, Advanced Server \u0026 Datacenter Server ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2003 Web Edition, Standard Edition, Enterprise Edition \u0026 Datacenter Edition.",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows NT 4.0 Server \u0026 Terminal Server Edition ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLe service WINS (Windows Internet Name Server) de Microsoft permet de\ntraduire le nom NetBIOS d\u0027une machine Windows en adresse IP, et\ninversement. La fonction appel\u00e9e WINS Replication qui permet le partage\nd\u0027informations entre serveurs WINS pr\u00e9sente une vuln\u00e9rabilit\u00e9 dans le\ntraitement des paquets re\u00e7us. Cette vuln\u00e9rabilit\u00e9 permet \u00e0 un\nutilisateur d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance au moyen d\u0027un\npaquet malicieusement constitu\u00e9.\n\n## Contournement provisoire\n\n-   Filtrer le port 42 (TCP \u0026 UDP) au niveau du pare-feu ;\n-   s\u00e9curiser les communications entre les serveurs WINS au moyen\n    d\u0027IPSec ;\n-   dans la mesure du possible, ne pas utiliser le service WINS.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. Documentation).\n",
  "cves": [],
  "initial_release_date": "2004-12-02T00:00:00",
  "last_revision_date": "2004-12-15T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 d\u0027IMMUNITY publi\u00e9 le 26 novembre 2004    :",
      "url": "http://www.immunitysec.com/downloads/instantanea.pdf"
    }
  ],
  "reference": "CERTA-2004-AVI-384",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-12-02T00:00:00.000000"
    },
    {
      "description": "Ajout du bulletin de s\u00e9curit\u00e9 Microsoft et de la section \u003cSPAN class=\"textit\"\u003eSolution\u003c/SPAN\u003e.",
      "revision_date": "2004-12-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 pr\u00e9sente dans le service WINS de Microsoft permet \u00e0 un\nutilisateur mal intentionn\u00e9 d\u0027ex\u00e9cuter du code arbitraire sur le syst\u00e8me\nvuln\u00e9rable.\n",
  "title": "Vuln\u00e9rabilit\u00e9 du service \u003cTT\u003eWINS\u003c/TT\u003e de Microsoft",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 US-CERT VU#145134",
      "url": "http://www.kb.cert.org/vuls/id/145134"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS04-045",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS04-045.mspx"
    }
  ]
}