certfr_avis - certa-2011-avi-692

CERTA-2011-AVI-692

Vulnerability from certfr_avis

Une vulnérabilité a été corrigée dans Active Directory, Active Directory en mode application (ADAM) et Active Directory Lightweight Directory Service (AD LDS). Cette vulnérabilité peut être utilisée par une personne malveillante authentifiée sur un domaine Active Directory afin d'exécuter du code arbitraire.

Description

Une vulnérabilité de type corruption de mémoire a été corrigée dans Active Directory en mode application (ADAM) et Active Directory Lightweight Directory Service (AD LDS). Cette vulnérabilité peut être exploitée par une personne malveillante authentifiée sur un domaine Active Directory à l'aide d'une application spécialement conçue pour exécuter du code arbitraire pouvant potentiellement compromettre l'ensemble du domaine.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	Windows	Windows Server 2003 Service Pack 2 : Active Directory en mode application (ADAM) :
Microsoft	Windows	Windows Server 2003 Édition x64 Service Pack 2 : Active Directory ;
Microsoft	Windows	Windows 7 pour systèmes x64 et Windows 7 pour systèmes x64 Service Pack 1 : Active Directory Lightweight Directory Service (AD LDS) ;
Microsoft	Windows	Windows 7 pour systèmes 32 bits et Windows 7 pour systèmes 32 bits Service Pack 1 : Active Directory Lightweight Directory Service (AD LDS) ;
Microsoft	Windows	Windows Vista Service Pack 2 : Active Directory Lightweight Directory Service (AD LDS) ;
Microsoft	Windows	Windows XP Professionnel Édition x64 Service Pack 2 : Active Directory en mode application (ADAM) ;
Microsoft	Windows	Windows Server 2008 pour systèmes 32 bits Service Pack 2 : Active Directory et Active Directory Lightweight Directory Service (AD LDS) ;
Microsoft	Windows	Windows Server 2003 Édition x64 Service Pack 2 : Active Directory en mode application (ADAM) ;
Microsoft	Windows	Windows Server 2008 pour systèmes x64 Service Pack 2 : Active Directory et Active Directory Lightweight Directory Service (AD LDS) ;
Microsoft	Windows	Windows Vista Édition x64 Service Pack 2 : Active Directory Lightweight Directory Service (AD LDS) ;
Microsoft	Windows	Windows XP Service Pack 3 : Active Directory en mode application (ADAM) ;
Microsoft	Windows	Windows Server 2003 Service Pack 2 : Active Directory ;
Microsoft	Windows	Windows Server 2003 avec SP2 pour systèmes Itanium : Active Directory ;
Microsoft	Windows	Windows Server 2008 R2 pour systèmes x64 et Windows Server 2008 R2 pour systèmes x64 Service Pack 1 : Active Directory et Active Directory Lightweight Directory Service (AD LDS).

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft MS11-095 du 13 décembre 2011

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows Server 2003 Service Pack 2 : Active Directory en mode application (ADAM) :",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2003 \u00c9dition x64 Service Pack 2 : Active Directory ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes x64 et Windows 7 pour syst\u00e8mes x64 Service Pack 1 : Active Directory Lightweight Directory Service (AD LDS) ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes 32 bits et Windows 7 pour syst\u00e8mes 32 bits Service Pack 1 : Active Directory Lightweight Directory Service (AD LDS) ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Vista Service Pack 2 : Active Directory Lightweight Directory Service (AD LDS) ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows XP Professionnel \u00c9dition x64 Service Pack 2 : Active Directory en mode application (ADAM) ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2 : Active Directory et Active Directory Lightweight Directory Service (AD LDS) ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2003 \u00c9dition x64 Service Pack 2 : Active Directory en mode application (ADAM) ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2 : Active Directory et Active Directory Lightweight Directory Service (AD LDS) ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Vista \u00c9dition x64 Service Pack 2 : Active Directory Lightweight Directory Service (AD LDS) ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows XP Service Pack 3 : Active Directory en mode application (ADAM) ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2003 Service Pack 2 : Active Directory ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2003 avec SP2 pour syst\u00e8mes Itanium : Active Directory ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 et Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1 : Active Directory et Active Directory Lightweight Directory Service (AD LDS).",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 de type corruption de m\u00e9moire a \u00e9t\u00e9 corrig\u00e9e dans\nActive Directory en mode application (ADAM) et Active Directory\nLightweight Directory Service (AD LDS). Cette vuln\u00e9rabilit\u00e9 peut \u00eatre\nexploit\u00e9e par une personne malveillante authentifi\u00e9e sur un domaine\nActive Directory \u00e0 l\u0027aide d\u0027une application sp\u00e9cialement con\u00e7ue pour\nex\u00e9cuter du code arbitraire pouvant potentiellement compromettre\nl\u0027ensemble du domaine.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2011-3406",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3406"
    }
  ],
  "initial_release_date": "2011-12-14T00:00:00",
  "last_revision_date": "2011-12-14T00:00:00",
  "links": [],
  "reference": "CERTA-2011-AVI-692",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2011-12-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans Active Directory, Active Directory\nen mode application (ADAM) et Active Directory Lightweight Directory\nService (AD LDS). Cette vuln\u00e9rabilit\u00e9 peut \u00eatre utilis\u00e9e par une\npersonne malveillante authentifi\u00e9e sur un domaine Active Directory afin\nd\u0027ex\u00e9cuter du code arbitraire.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Active Directory",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS11-095 du 13 d\u00e9cembre 2011",
      "url": "http://technet.microsoft.com/en-us/security/bulletin/MS11-095"
    }
  ]
}

CVE-2011-3406 (GCVE-0-2011-3406)

Vulnerability from cvelistv5

Published

2011-12-14 00:00

Modified

2025-01-21 18:21

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Summary

Buffer overflow in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote authenticated users to execute arbitrary code via a crafted query that leverages incorrect memory initialization, aka "Active Directory Buffer Overflow Vulnerability."

References

URL

Tags

	http://www.us-cert.gov/cas/techalerts/TA11-347A.html	third-party-advisory, x_refsource_CERT
	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-095	vendor-advisory, x_refsource_MS
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14037	vdb-entry, signature, x_refsource_OVAL

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:29:56.905Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "TA11-347A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-347A.html"
          },
          {
            "name": "MS11-095",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-095"
          },
          {
            "name": "oval:org.mitre.oval:def:14037",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14037"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2011-3406",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-12-11T20:34:05.030449Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-21T18:21:42.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote authenticated users to execute arbitrary code via a crafted query that leverages incorrect memory initialization, aka \"Active Directory Buffer Overflow Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "TA11-347A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-347A.html"
        },
        {
          "name": "MS11-095",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-095"
        },
        {
          "name": "oval:org.mitre.oval:def:14037",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14037"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2011-3406",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Buffer overflow in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote authenticated users to execute arbitrary code via a crafted query that leverages incorrect memory initialization, aka \"Active Directory Buffer Overflow Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "TA11-347A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-347A.html"
            },
            {
              "name": "MS11-095",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-095"
            },
            {
              "name": "oval:org.mitre.oval:def:14037",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14037"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2011-3406",
    "datePublished": "2011-12-14T00:00:00",
    "dateReserved": "2011-09-09T00:00:00",
    "dateUpdated": "2025-01-21T18:21:42.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTA-2011-AVI-692

Vulnerability from certfr_avis

Description

Solution

CVE-2011-3406 (GCVE-0-2011-3406)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature