=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2009/VULN455
_____________________________________________________________________

DATE                      : 12/11/2009

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Windows 2000, Windows XP, Windows Server 2003,
                                Windows Server 2008 running Active Directory.

======================================================================
KB973309
http://www.microsoft.com/technet/security/bulletin/ms09-066.mspx
______________________________________________________________________


Microsoft Security Bulletin MS09-066 - Important

Vulnerability in Active Directory Could Allow Denial of Service (973309)

   Published: November 10, 2009

   Version: 1.0

General Information

Executive Summary

   This security update resolves a privately reported vulnerability in
   Active Directory directory service, Active Directory Application Mode
   (ADAM), and Active Directory Lightweight Directory Service (AD LDS).
   The vulnerability could allow denial of service if stack space was
   exhausted during execution of certain types of LDAP or LDAPS requests.
   This vulnerability only affects domain controllers and systems
   configured to run ADAM or AD LDS.

   This security update is rated Important for Active Directory, ADAM, and
   AD LDS on all supported editions of Microsoft Windows 2000 Server, Windows
   XP, Windows Server 2003, and Windows Server 2008. For more information,
   see the subsection, Affected and Non-Affected Software, in this section.

   The security update addresses the vulnerability by changing the way Active
   Directory, ADAM, and AD LDS process malformed LDAP or LDAPS requests. For
   more information about the vulnerability, see the Frequently Asked
   Questions (FAQ) subsection for the specific vulnerability entry under the
   next section, Vulnerability Information.

Affected Software

   Microsoft Windows 2000 Server Service Pack 4
   Windows XP Service Pack 2 and Windows XP Service Pack 3
   Windows XP Professional x64 Edition Service Pack 2
   Windows Server 2003 Service Pack 2
   Windows Server 2003 x64 Edition Service Pack 2
   Windows Server 2003 with SP2 for Itanium-based Systems
   Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit
     Systems Service Pack 2*
   Windows Server 2008 for x64-based Systems and Windows Server 2008 for
     x64-based Systems Service Pack 2*

   *Server Core installation affected.

Vulnerability Information

LSASS Recursive Stack Overflow Vulnerability - CVE-2009-1928

   A denial of service vulnerability exists in implementations of Active
   Directory on Microsoft Windows 2000 Server, Windows Server 2003, and
   Windows Server 2008. The vulnerability also exists in implementations of
   Active Directory Application Mode (ADAM) when installed on Windows XP and
   Windows Server 2003, and Active Directory Lightweight Directory Service
   (AD LDS) on Windows Server 2008. The vulnerability is due to stack space
   exhaustion during execution of certain types of LDAP or LDAPS requests. An
   attacker who successfully exploited this vulnerability could cause the
   affected system to stop responding.

======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================