{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Windows NT Server 4.0 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows XP ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2003.",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows NT 4.0 Terminal Server Edition ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows 2000 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows NT Workstation 4.0 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDeux vuln\u00e9rabilit\u00e9s dans le service Microsoft RPCSS permettent \u00e0 un\nutilisateur distant mal intentionn\u00e9 d\u0027ex\u00e9cuter du code arbitraire \u00e0\ndistance avec les privil\u00e8ges du compte Local System. Ces vuln\u00e9rabilit\u00e9s\naffectent l\u0027interface DCOM (Distributed Component Object Model) qui\ns\u0027appuie sur l\u0027infrastructure RPC.\n\nUne troisi\u00e8me vuln\u00e9rabilit\u00e9 affectant Microsoft Windows 2000 permet, via\nl\u0027envoi de paquets judicieusement compos\u00e9s en direction du service\nRPCSS, de r\u00e9aliser un d\u00e9ni de service sur la machine cible.\n\nDes programmes permettant d\u0027exploiter cette vuln\u00e9rabilit\u00e9 sont largement\ndiffus\u00e9s sur l\u0027Internet.\n\n## Contournement provisoire\n\n-   Filtrer les ports RPC (135 TCP/UDP, 137 UDP, 138 UDP, 139 TCP, 445\n    TCP/UDP, 593 TCP) avec un \u00e9l\u00e9ment de filtrage en amont ;\n-   COM Internet Services est un \u00e9l\u00e9ment permettant de faire passer des\n    messages RPC par le protocole HTTP. Il est recommand\u00e9 de d\u00e9sactiver\n    cet \u00e9l\u00e9ment ou de filter les ports 80 et 443 TCP ;\n-   d\u00e9sactiver l\u0027interface DCOM.\n\n## Solution\n\nAppliquer le correctif fourni par Microsoft suivant la version du\nsyst\u00e8me d\u0027exploitation (cf. Documentation).\n",
  "cves": [],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 MS03-039 de Microsoft :",
      "url": "http://www.microsoft.com/technet/security/bulletin/ms03-039.asp"
    }
  ],
  "reference": "CERTA-2003-AVI-149",
  "revisions": [
    {
      "description": "version initiale ;",
      "revision_date": "2003-09-11T00:00:00.000000"
    },
    {
      "description": "ajout d\u0027informations.",
      "revision_date": "2003-09-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "Trois vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le service RPCSS sous\nWindows.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans le service RPCSS sous Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin Microsoft MS03-039",
      "url": null
    }
  ]
}