{"$ref":"https://www.cert.ssi.gouv.fr/openapi.json","affected_systems":[{"description":"Windows Server 2022","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2012","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 21H1 for ARM64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 8.1 for 32-bit systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2019 (Server Core installation)","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2019","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2012 R2","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 21H2 for x64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 7 for 32-bit Systems Service Pack 1","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 1909 for 32-bit Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2022 (Server Core installation)","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 20H2 for ARM64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 21H1 for x64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 11 for x64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2016 (Server Core installation)","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2008 R2 for x64-based Systems Service Pack 1","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 20H2 for x64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2008 for 32-bit Systems Service Pack 2","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows RT 8.1","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 8.1 for x64-based systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 1809 for x64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 20H2 for 32-bit Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2012 (Server Core installation)","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 21H1 for 32-bit Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 1809 for ARM64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 21H2 for ARM64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 1607 for 32-bit Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2008 for x64-based Systems Service Pack 2","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2016","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 1607 for x64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 1809 for 32-bit Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server, version 20H2 (Server Core Installation)","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 1909 for ARM64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 11 for ARM64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 21H2 for 32-bit Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 for x64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 Version 1909 for x64-based Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2012 R2 (Server Core installation)","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 10 for 32-bit Systems","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows 7 for x64-based Systems Service Pack 1","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}}],"affected_systems_content":null,"closed_at":"2022-05-04","content":"## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l'\u00e9diteur pour l'obtention des\ncorrectifs (cf. section Documentation).\n\n<span style=\"color: #ff0000;\">**\\[mise \u00e0 jour du 15 avril\n2022\\]**</span>\n\nLorsque les correctifs ne peuvent pas \u00eatre appliqu\u00e9s, il est pr\u00e9f\u00e9rable\nde proc\u00e9der, par ordre de pr\u00e9f\u00e9rence :\n\n-   \u00e0 la d\u00e9connexion des syst\u00e8mes affect\u00e9s du r\u00e9seau ;\n-   au filtrage, sur les syst\u00e8mes affect\u00e9s, des ports r\u00e9seaux suivants\n    en entr\u00e9e :\n    -   les ports TCP/139 et TCP/445 dans la mesure o\u00f9 *SMB* est un\n        vecteur de transport de nombreuses interfaces *RPC* ;\n    -   les ports UDP/135, TCP/135 ainsi que la plage de ports dynamique\n        utilis\u00e9s par l'\u00e9cosyst\u00e8me *RPC.*\n","cves":[{"name":"CVE-2022-26809","url":"https://www.cve.org/CVERecord?id=CVE-2022-26809"}],"links":[{"title":"[1] Guide Microsoft sur la s\u00e9curisation du flux SMB","url":"https://docs.microsoft.com/fr-fr/windows-server/storage/file-server/smb-secure-traffic"},{"title":"[3] Recommandations sur le nomadisme num\u00e9rique","url":"https://www.ssi.gouv.fr/guide/recommandations-sur-le-nomadisme-numerique/"},{"title":"[2] Bulletin d'actualit\u00e9 CERT-FR","url":"https://www.cert.ssi.gouv.fr/actualite/CERTFR-2020-ACT-001/"}],"reference":"CERTFR-2022-ALE-003","revisions":[{"description":"Version initiale","revision_date":"2022-04-13T00:00:00.000000"},{"description":"mise \u00e0 jour des recommandations","revision_date":"2022-04-15T00:00:00.000000"},{"description":"Cl\u00f4ture de l'alerte. Cela ne signifie pas la fin d'une menace. Seule l'application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l'exploitation de la vuln\u00e9rabilit\u00e9 correspondante.","revision_date":"2022-05-04T00:00:00.000000"}],"risks":[{"description":"Ex\u00e9cution de code arbitraire \u00e0 distance"}],"summary":"<strong><span style=\"color: #ff0000;\">\\[mise \u00e0 jour du 15 avril\n2022\\]</span></strong>\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans l'impl\u00e9mentation Microsoft du\nprotocole *RPC* - *Remote Procedure Call* -\u00a0 protocole permettant\nd'effectuer des appels de proc\u00e9dures sur des machines distantes. Elle\npermet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0\ndistance. En particulier, cette vuln\u00e9rabilit\u00e9 affecte le protocole\n*SMB* - *Server Message Block* - qui permet notamment le partage de\nressources comme les fichiers ou les imprimantes.\n\n<strong>Le CERT-FR recommande d'appliquer la mise \u00e0 jour dans les plus brefs\nd\u00e9lais,</strong> en priorit\u00e9 sur les syst\u00e8mes les plus critiques (notamment les\ncontr\u00f4leurs de domaine *Active Directory*). Au vu de la criticit\u00e9 de\ncette vuln\u00e9rabilit\u00e9, l'\u00e9diteur a publi\u00e9 des correctifs de s\u00e9curit\u00e9 pour\ndes syst\u00e8mes qui ne sont plus support\u00e9s (en particulier, Windows 7 et\nWindows Server 2008 R2).\n\n<strong>Il est \u00e9galement requis de proc\u00e9der \u00e0 une revue des r\u00e8gles de filtrage\nafin de s'assurer du respect des bonnes pratiques de s\u00e9curisation des\nenvironnements Microsoft (notamment \\[1\\], \\[2\\], \\[3\\]).</strong>\n","title":"[M\u00e0J] Vuln\u00e9rabilit\u00e9 dans l'impl\u00e9mentation du protocole RPC par Microsoft","vendor_advisories":[{"published_at":null,"title":"Bulletin de s\u00e9curit\u00e9 Microsoft du 12 avril 2022","url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-26809"}]}