{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Windows Server 2003 ex\u00e9cutant Microsoft Data Access Components 2.8 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows XP Service Pack 2 ex\u00e9cutant Microsoft Data Access Components 2.8 Service Pack 1 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2003 Service Pack 1 pour syst\u00e8mes Itanium ex\u00e9cutant Microsoft Data Access Components 2.8 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2003 pour syst\u00e8mes Itanium ex\u00e9cutant Microsoft Data Access Components 2.8 Service Pack 2 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows XP Service Pack 1 ex\u00e9cutant Microsoft Data Access Components 2.7 Service Pack 1 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2003 Edition 64 bits ex\u00e9cutant Microsoft Data Access Components 2.8 Service Pack 2 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows XP Professionnel Edition 64 bits ex\u00e9cutant Microsoft Data Access Components 2.8 Service Pack 2 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nRDS (Remote Data Service) est une fonctionnalit\u00e9 d\u0027ADO (ActiveX Data\nObject) distribu\u00e9 par MDAC Microsoft Data Access Components.  \nRDS est utilis\u00e9 pour d\u00e9placer des donn\u00e9es d\u0027un serveur vers une\napplication client ou vers une page web.  \n\nUne vuln\u00e9rabilit\u00e9 est pr\u00e9sente dans l\u0027ActiveX RDS.Dataspace. Cette\nvuln\u00e9rabilit\u00e9 peut \u00eatre exploit\u00e9e par un utilisateur mal intentionn\u00e9,\nvia un site web construit de fa\u00e7on malveillante, pour ex\u00e9cuter du code\narbitraire ou r\u00e9aliser un d\u00e9ni de service sur le poste de l\u0027utilisateur\nparcourant ce site web.\n\n## Contournement provisoire\n\n-   Configurer Internet Explorer de fa\u00e7on \u00e0 ne pas autoriser\n    automatiquement le t\u00e9l\u00e9chargement et l\u0027ex\u00e9cution des contr\u00f4les\n    ActiveX ;\n-   D\u00e9sactiver le contr\u00f4le ActiveX RDS.Dataspace.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2006-04-12T00:00:00",
  "last_revision_date": "2006-04-12T00:00:00",
  "links": [],
  "reference": "CERTA-2006-AVI-151",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-04-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 pr\u00e9sente dans le contr\u00f4le ActiveX RDS.Dataspace\ndistribu\u00e9 par Microsoft Data Access Components, peut \u00eatre exploit\u00e9e par\nun utilisateur mal intentionn\u00e9 pour r\u00e9aliser un d\u00e9ni de service ou\nex\u00e9cuter du code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 sur la fonction Microsoft Data Access Components (MDAC)",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS06-014",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS06-014.mspx"
    }
  ]
}