PT-2013-4709 · Microsoft · Windows Rt+8

Daniel Letkiewicz · Publicado 2013-11-16 · Atualizado 2019-05-14 · CVE-2013-3876

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP versions SP2 and SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista versions SP1 and SP2 Microsoft Windows Server 2008 versions SP2 and R2 SP1 Microsoft Windows 7 version SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 versions Gold and R2 Microsoft Windows RT versions Gold and 8.1

Description The issue is related to the improper verification of server X.509 certificates by DirectAccess in Microsoft Windows. This allows man-in-the-middle attackers to spoof servers and read encrypted domain credentials via a crafted certificate.

Recommendations For Microsoft Windows XP versions SP2 and SP3, update the operating system to a newer version that properly verifies server X.509 certificates. For Microsoft Windows Server 2003 version SP2, update the operating system to a newer version that properly verifies server X.509 certificates. For Microsoft Windows Vista versions SP1 and SP2, update the operating system to a newer version that properly verifies server X.509 certificates. For Microsoft Windows Server 2008 versions SP2 and R2 SP1, update the operating system to a newer version that properly verifies server X.509 certificates. For Microsoft Windows 7 version SP1, update the operating system to a newer version that properly verifies server X.509 certificates. For Microsoft Windows 8, update the operating system to a newer version that properly verifies server X.509 certificates. For Microsoft Windows 8.1, update the operating system to a newer version that properly verifies server X.509 certificates. For Microsoft Windows Server 2012 versions Gold and R2, update the operating system to a newer version that properly verifies server X.509 certificates. For Microsoft Windows RT versions Gold and 8.1, update the operating system to a newer version that properly verifies server X.509 certificates.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-3876

Produtos afetados

Windows 7

Windows 8

Windows 8.1

Windows Rt

Windows Server 2003

Windows Server 2008

Windows Server 2012

Windows Vista

Windows Xp

Referências · 2

• http://technet.microsoft.com/security/advisory/2862152 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-3876 · Nota de Segurança