{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Windows Server 64 bit Edition.",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows 64 bit Edition ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Server 2003 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows 2000, Service Pack 2, 3 et 4 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows NT Workstation 4.0, Service Pack 6a ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows NT Server 4.0, Terminal Server Edition, Service Pack 6a ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows NT Server 4.0, Service Pack 6a ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows 64 bit Edition Version 2003 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows XP Gold, Service Pack 1 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLes messages Windows permettent aux processus interactifs de r\u00e9agir aux\n\u00e9v\u00e9nements utilisateur ou de communiquer avec les autres processus\ninteractifs.\n\nL\u0027une des fonctions de la biblioth\u00e8que `User32.dll` qui permet de\nfournir la liste des options d\u0027acc\u00e8s aux utilisateurs ne valide pas\ncorrectement certains de ses param\u00e8tres pour les messages Windows qui\nlui sont envoy\u00e9s. L\u0027envoi d\u0027un message malicieusement form\u00e9 \u00e0 un\nprocessus interactif peut faire ex\u00e9cuter aux contr\u00f4les `ListBox` et\n`ComboBox` du code arbitraire.\n\nUn utilisateur mal intentionn\u00e9 peut utiliser cette vuln\u00e9rabilit\u00e9\npr\u00e9sente dans toutes les applications mettant en \u0153uvre ces contr\u00f4les\nafin d\u0027\u00e9l\u00e9ver ses privil\u00e8ges.\n\n## Solution\n\nAppliquer le correctif suivant la version de Microsoft Windows concern\u00e9e\n(cf. Documentation).\n",
  "cves": [],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 #MS03-045 de Microsoft :",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS03-045.asp"
    }
  ],
  "reference": "CERTA-2003-AVI-170",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2003-10-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une fonction de la biblioth\u00e8que `User32.dll` pr\u00e9sente une vuln\u00e9rabilit\u00e9\nde type d\u00e9bordement de m\u00e9moire. Cette fonction est utilis\u00e9e par les\ncontr\u00f4les `ListBox` et `ControlBox`.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les contr\u00f4les ListBox et ComboBox",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin #MS03-045 de Microsoft",
      "url": null
    }
  ]
}