CVE:CVE-2009-0550
CNNVD:CNNVD-200904-285
Microsoft Windows是美国微软（Microsoft）公司发布的一系列操作系统。
Windows的HTTP服务没有正确地实现NTLM凭据反射保护以确保用户的凭据没有被反射和使用。如果用户连接到了攻击者的WEB服务器，Windows HTTP服务处理NTLM凭据的方式存允许攻击者重放用户凭据并以登录用户的权限执行任意代码。如果用户使用管理用户权限登录，成功利用此漏洞的攻击者便可完全控制受影响的系统。
solution:Upgrade microsoft windows_2000 to a higher version than *:sp4,and avoid the version *:sp4; Upgrade microsoft windows_server_2003 to a higher version than *,*:sp1,*:sp2,and avoid the version *:sp1,*:sp2; Upgrade microsoft windows_server_2008 to a higher version than *; Upgrade microsoft windows_vista to a higher version than *,*:sp1,gold,and avoid the version *:sp1,gold; Upgrade microsoft windows_xp to a higher version than *,*:sp2,*:sp3,and avoid the version *:sp2,*:sp3; Upgrade microsoft ie to a higher version than 6.0:sp1,and avoid the version 6.0:sp1; Upgrade microsoft internet_explorer to a higher version than 5.01:sp4,6,7,and avoid the version 5.01:sp4,6,7