{"$ref":"https://www.cert.ssi.gouv.fr/openapi.json","affected_systems":[{"description":"Microsoft Windows Server 2003 \u00c9dition x64 Service Pack 2 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows XP Professionnel \u00c9dition x64 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows Vista ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows Vista \u00c9dition x64.","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows Server 2003 avec SP1 pour les syst\u00e8mes Itanium ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows Server 2003 avec SP2 pour les syst\u00e8mes Itanium ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows Server 2003 Service Pack 1 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows Server 2003 \u00c9dition x64 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows XP Service Pack 2 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows XP Professionnel \u00c9dition x64 Service Pack 2 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows Server 2003 Service Pack 2 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows 2000 Service Pack 4 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}}],"affected_systems_content":null,"content":"## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans le client DNS de Microsoft\nWindows. Il s'agit du client en charge de la r\u00e9solution des noms de\nmachines en adresses IP.\n\nLa vuln\u00e9rabilit\u00e9 permettrait \u00e0 une personne malveillante d'usurper une\nr\u00e9ponse DNS l\u00e9gitime en pr\u00e9disant les valeurs de transaction du client.\n\nCette mauvaise r\u00e9ponse serait alors interpr\u00e9t\u00e9e sur le syst\u00e8me\nvuln\u00e9rable qui pourrait rediger une partie de son trafic vers une\nadresse IP non l\u00e9gitime.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 MS08-020 de Microsoft pour\nl'obtention des correctifs (cf. section Documentation).\n","cves":[{"name":"CVE-2008-0087","url":"https://www.cve.org/CVERecord?id=CVE-2008-0087"}],"links":[],"reference":"CERTA-2008-AVI-191","revisions":[{"description":"version initiale.","revision_date":"2008-04-09T00:00:00.000000"}],"risks":[{"description":"D\u00e9ni de service \u00e0 distance"},{"description":"Contournement de la politique de s\u00e9curit\u00e9"},{"description":"Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"}],"summary":"Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans le client DNS de Microsoft\nWindows. Elle permettrait \u00e0 une personne malveillante d'usurper une\nr\u00e9ponse DNS l\u00e9gitime, afin de tromper le syst\u00e8me et l'amener \u00e0 contacter\nune machine non l\u00e9gitime.\n","title":"Vuln\u00e9rabilit\u00e9 du client DNS de Microsoft Windows","vendor_advisories":[{"published_at":null,"title":"Bulletin de s\u00e9curit\u00e9 Microsoft MS08-020 du 08 avril 2008","url":"http://www.microsoft.com/technet/security/Bulletin/MS08-020.mspx"}]}