=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN503
_____________________________________________________________________

DATE                : 13/11/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Windows version XP, Server 2003, Vista,
                        Server 2008, 7, 8, 8.1, RT, RT 8.1, Server 2012.

======================================================================
KB2868626
https://technet.microsoft.com/en-us/security/bulletin/ms13-095
______________________________________________________________________

Microsoft Security Bulletin MS13-095 - Important Vulnerability in
Digital Signatures Could Allow Denial of Service (2868626)

Published: Tuesday, November 12, 2013

Version: 1.0


General Information

Executive Summary

This security update resolves a privately reported vulnerability in
Microsoft Windows. The vulnerability could allow denial of service when
an affected web service processes a specially crafted X.509 certificate.

This security update is rated Important for all supported editions of
Microsoft Windows.


Affected Software

Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows 8 for 32-bit Systems
Windows 8 for x64-based Systems
Windows 8.1 for 32-bit Systems
Windows 8.1 for x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows RT
Windows RT 8.1
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
  installation)
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
  installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation)
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2 (Server Core installation)


Vulnerability Information

Digital Signatures Vulnerability - CVE-2013-3869

A denial of service vulnerability exists in implementations of X.509
certificate parsing that could cause an affected web service to stop
responding. The vulnerability is caused when the X.509 certificate
validation operation fails to handle a specially crafted X.509
certificate.

To view this vulnerability as a standard entry in the Common
Vulnerabilities and Exposures list, see CVE-2013-3869.


=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================