Vulnerability Bulletins |
Suplantación de identidad en Microsoft Windows a través de Schannel |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Confidencialidad |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | Microsoft |
| Affected software |
Microsoft Windows 2000 SP4 Microsoft XP SP2 y SP3 Microsoft Server 2003 SP1 y SP2 Microsoft Vista SP1 Microsoft Server 2008 |
Description |
|
|
Se ha descubierto una vulnerabilidad en Microsoft Windows 2000 SP4, XP SP2 y SP3, Server 2003 SP1 y SP2, Vista SP1 y Server 2008. La vulnerabilidad reside en un error en la validación del intercambio de claves del cliente en el componente de autenticación Secure Channel. Un atacante remoto podría suplantar la autenticación mediante un paquete TLS especialmente diseñado. El boletín MS09-007 sustituye al MS07-031. |
|
Solution |
|
|
Actualización de software Microsoft Microsoft Windows 2000 SP4 / patch Windows2000-kb960225-x86-enu Windows XP SP2 / patch Windowsxp-kb960225-x86-enu Windows XP Professional x64 Edition / patch Windowsserver2003-kb960225-x86-enu Windows XP Professional x64 Edition SP2 / patch Windowsserver2003-kb960225-x86-enu Windows Server 2003 Service Pack 1 / patch Windowsserver2003-kb960225-x86-enu Windows Server 2003 Service Pack 2 / patch Windowsserver2003-kb960225-x86-enu Windows Server 2003 x64 Edition / patch Windowsserver2003-kb960225-x86-enu Windows Server 2003 x64 Edition SP2 / patch Windowsserver2003-kb960225-x86-enu Windows Server 2003 Itanium SP1 / patch Windowsserver2003.windowsxp-kb960225-x64-enu Windows Server 2003 Itanium SP2 / patch Windowsserver2003.windowsxp-kb960225-x64-enu Microsoft Windows Vista SP1 (32 bit) / patch Windows6.0-KB960225-x86 Microsoft Windows Vista SP1 (64 bit) / patch Windows6.0-KB960225-x64 Microsoft Windows Server 2008 (32 bit) / patch Windows6.0-KB960225-x86 Microsoft Windows Server 2008 (64 bit) / patch Windows6.0-KB960225-x64 Microsoft Windows Server 2008 (Itanium) / patch Windows6.0-KB960225-ia64 http://www.microsoft.com/downloads |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2009-0085 |
| BID | |
Other resources |
|
|
Microsoft Security Bulletin (MS09-007) http://www.microsoft.com/technet/security/bulletin/MS09-007.mspx |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2009-03-11 |