====================================================================

                             CERT-Renater

                  Note d'Information No. 2012/VULN486
____________________________________________________________________

DATE                : 12/12/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Windows Server 2008, Server 2012
                       running IP-HTTPS Component.

======================================================================
KB2765809
http://technet.microsoft.com/en-us/security/bulletin/ms12-083
______________________________________________________________________

Microsoft Security Bulletin MS12-083 - Important Vulnerability in
IP-HTTPS Component Could Allow Security Feature Bypass (2765809)

Published Date: December 11, 2012

Version: 1.0


General Information

Executive Summary

This security update resolves a privately reported vulnerability in
Microsoft Windows. The vulnerability could allow security feature
bypass if an attacker presents a revoked certificate to an IP-HTTPS
server commonly used in Microsoft DirectAccess deployments. To exploit
the vulnerability, an attacker must use a certificate issued from the
domain for IP-HTTPS server authentication. Logging on to a system
inside the organization would still require system or domain
credentials.

This security update is rated Important for all supported editions of
Windows Server 2008 R2 and Windows Server 2012.


Affected Software

Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation)
Windows Server 2012 (Server Core installation)


Vulnerability Information

Revoked Certificate Bypass Vulnerability - CVE-2012-2549

A security feature bypass vulnerability exists in Windows due to the
way the IP-HTTPS Component handles certificates. An attacker who
successfully exploited this vulnerability could bypass certificate
validation checks.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================