PT-2016-1044 · Microsoft · Windows 10+1

Publicado 2016-01-12 · Atualizado 2018-10-30 · CVE-2016-0019

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 10 versions Gold and 1511

Description The issue is related to a security feature bypass in the Remote Desktop Protocol (RDP) service implementation, allowing remote attackers to bypass intended access restrictions. This can enable attackers to establish sessions for accounts with blank passwords via a modified RDP client. The vulnerability is caused by errors in security settings, which can be exploited by a remote attacker to bypass existing access restrictions or establish a connection for an account with a blank password.

Recommendations For Microsoft Windows 10 versions Gold and 1511, consider disabling the RDP service until a patch is available to prevent remote logon to accounts with no passwords set. As a temporary workaround, restrict access to accounts with blank passwords to minimize the risk of exploitation. Avoid using blank passwords for accounts to prevent potential exploitation of this issue.

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

BDU:2016-00111

CVE-2016-0019

Produtos afetados

Windows 10

Windows

Referências · 6

• http://technet.microsoft.com/security/bulletin/MS16-007 · Nota
• https://bdu.fstec.ru/vul/2016-00111 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-0019 · Aviso do Fabricante
• http://securitytracker.com/id/1034659 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-007 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0019 · Nota de Segurança