{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Windows Server 2003 Enterprise Edition ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows XP Home Edition ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2003 Web Edition ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows XP Professional ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2000 Datacenter Server.",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2003 Datacenter Edition ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2000 Advanced Server ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2000 Professional ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2000 Server ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2003 Standard Edition ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\n-   Une mauvaise gestion de la pile dans MSDTC (Microsoft Distributed\n    Transaction Coordinator) peut \u00eatre exploit\u00e9e par un utilisateur mal\n    intentionn\u00e9 afin d\u0027ex\u00e9cuter du code arbitraire en local et/ou \u00e9lever\n    ses privil\u00e8ges. Cette vuln\u00e9rabilit\u00e9 touche les versions suivantes de\n    Microsoft :\n    -   Windows 2000 ;\n    -   Windows XP Service Pack 1 ;\n    -   Windows Server 2003.\n\n-   Une erreur dans le composant COM+ peut \u00eatre exploit\u00e9e par un\n    utilisateur mal intentionn\u00e9 afin d\u0027ex\u00e9cuter du code arbitraire \u00e0\n    distance par le biais d\u0027un paquet r\u00e9seau sp\u00e9cialement con\u00e7u, ou en\n    local par le biais d\u0027une application sp\u00e9cialement construite. Cette\n    vuln\u00e9rabilit\u00e9 touche les versions suivantes de Microsoft :\n    -   Windows 2000 (ex\u00e9cution de code \u00e0 distance) ;\n    -   Windows XP Service Pack 1 (ex\u00e9cution de code \u00e0 distance);\n    -   Windows XP Service Pack 2 (ex\u00e9cution de code en local);\n    -   Windows Server 2003 (ex\u00e9cution de code en local);\n    -   Windows Server 2003 Service Pack 1 (ex\u00e9cution de code en local).\n\n-   Une erreur dans la validation des requ\u00eates TIP (Transaction Internet\n    Protocol) par MSDTC peut \u00eatre exploit\u00e9e \u00e0 distance, via un paquet\n    malicieusement contruit, afin de bloquer les r\u00e9ponses du service. Le\n    paquet malicieux peut \u00eatre transf\u00e9r\u00e9 aux autres machines du r\u00e9seau \u00e0\n    travers la premi\u00e8re machine affect\u00e9e, ce qui aura pour cause l\u0027arr\u00eat\n    de MSDTC sur l\u0027ensemble de ces machines.\n\n    Les machines n\u0027interpr\u00e9tant pas le protocole TIP ne sont pas\n    vuln\u00e9rables.\n\n## Solution\n\nAppliquer les correctifs comme indiqu\u00e9 par l\u0027\u00e9diteur (cf.\nDocumentation).\n",
  "cves": [],
  "initial_release_date": "2005-10-12T00:00:00",
  "last_revision_date": "2005-10-24T00:00:00",
  "links": [
    {
      "title": "D\u00e9tails sur le bulletin de s\u00e9curit\u00e9 Microsoft #909444 :",
      "url": "http://support.microsoft.com/kb/909444"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft num\u00e9ro MS05-051 :",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS05-051.mspx"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft KB #909444 :",
      "url": "http://www.microsoft.com/technet/security/advisory/909444.mspx"
    }
  ],
  "reference": "CERTA-2005-AVI-403",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2005-10-12T00:00:00.000000"
    },
    {
      "description": "ajout du bulletin de s\u00e9curit\u00e9 #909444 Microsoft.",
      "revision_date": "2005-10-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de commandes arbitraire locale ou distante"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Acc\u00e8s ill\u00e9gal au syst\u00e8me"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Les services MSDTC et COM+ sont vuln\u00e9rables \u00e0 de multiples\nvuln\u00e9rabilit\u00e9s, pouvant \u00eatre exploit\u00e9es en local ou \u00e0 distance par un\nutilisateur malveillant.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Windows MSDTC et COM+",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS05-051",
      "url": null
    }
  ]
}