PT-2013-4702 · Microsoft · Windows Rt+9

Published 2013-11-12 · Updated 2019-05-14 · CVE-2013-3869

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP SP2 and SP3 Microsoft Windows Server 2003 SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Microsoft Windows RT Gold and 8.1

Description A denial of service issue exists due to improper handling of crafted X.509 certificates during validation. This can cause a web service to stop responding when it encounters a specially crafted X.509 certificate. The issue arises from the failure of the X.509 certificate validation operation to handle such certificates correctly.

Recommendations For Microsoft Windows XP SP2 and SP3, apply the fix to handle X.509 certificates properly. For Microsoft Windows Server 2003 SP2, update the X.509 certificate validation operation. For Microsoft Windows Vista SP2, ensure proper handling of crafted X.509 certificates. For Microsoft Windows Server 2008 SP2 and R2 SP1, apply the patch to fix the X.509 certificate parsing issue. For Microsoft Windows 7 SP1, update to a version that properly handles X.509 certificate validation. For Microsoft Windows 8, apply the fix for the denial of service vulnerability. For Microsoft Windows 8.1, ensure the X.509 certificate validation operation is updated. For Microsoft Windows Server 2012 Gold and R2, apply the patch to prevent the web service from stopping responding. For Microsoft Windows RT Gold and 8.1, update the X.509 certificate parsing to handle crafted certificates correctly.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-3869

Affected Products

Windows

Windows 7

Windows 8

Windows 8.1

Windows Rt

Windows Server 2003

Windows Server 2008

Windows Server 2012

Windows Vista

Windows Xp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-3869 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-095 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3869 · Security Note
• http://us-cert.gov/ncas/alerts/TA13-317A · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19112 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-095 · Note