PT-2005-2931 · Microsoft · Windows 2000+2

Aaron Jaggard + 4 · Published 2005-08-10 · Updated 2019-04-30 · CVE-2005-1982

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patchday that contains the fix for this issue

Description The issue allows a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used. This occurs due to an unknown vulnerability in the PKINIT Protocol.

Recommendations For Microsoft Windows 2000, Windows XP, and Windows Server 2003, apply the patch from the patchday that contains the fix for this issue to resolve the problem. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-1982

Affected Products

Windows 2000

Windows Server 2003

Windows Xp

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2005-1982 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-042 · Vendor Advisory
• http://secunia.com/advisories/16368 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100096 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100100 · Note
• http://securitytracker.com/id?1014642 · Note
• http://kb.cert.org/vuls/id/477341 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100104 · Note
• http://securityfocus.com/bid/14520 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100098 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100106 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100102 · Note