PT-2011-3001 · Microsoft · Windows Vista+3

Publicado 2011-07-13 · Atualizado 2019-09-27 · CVE-2011-1265

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Bluetooth 2.1 Stack versions in Microsoft Windows Vista SP1 and SP2 and Windows 7 Gold and SP1

Description A remote code execution issue exists due to improper access to objects in memory that were not correctly initialized or have been deleted. This allows remote attackers to execute arbitrary code via crafted Bluetooth packets. An attacker could exploit this issue by sending specially crafted Bluetooth packets to the target machine, potentially allowing them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Windows Vista SP1 and SP2, update the Bluetooth Stack to a version that properly initializes and handles objects in memory. For Windows 7 Gold and SP1, update the Bluetooth Stack to a version that properly initializes and handles objects in memory. As a temporary workaround, consider disabling Bluetooth functionality until a patch is available.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2011-1265

Produtos afetados

Windows

Windows 7

Windows Bluetooth 2.1 Stack

Windows Vista

Referências · 6

• https://docs.microsoft.com/security-updates/securitybulletins/2011/MS11-053 · Nota
• http://us-cert.gov/cas/techalerts/TA11-193A.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1265 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12094 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1265 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-053 · Aviso do Fabricante