PT-2016-1231 · Microsoft · Windows Server 2012 R2+3

Publicado 2016-02-09 · Atualizado 2019-05-15 · CVE-2016-0044

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8.1 Windows Server versions 2012 R2 Windows RT versions 8.1

Description The issue is related to insufficient input validation in the Sync Framework component, allowing remote attackers to cause a denial of service by sending specially crafted "change batch" data. This could lead to a SyncShareSvc service outage, preventing authenticated users from using the service. However, it does not allow an attacker to execute code or elevate their user rights.

Recommendations For Microsoft Windows 8.1, consider restricting access to the SyncShareSvc service until a fix is available. For Windows Server 2012 R2, avoid using the Sync Framework component with untrusted input data. For Windows RT 8.1, as a temporary workaround, consider disabling the SyncShareSvc service to prevent potential exploitation.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-00492

CVE-2016-0044

Produtos afetados

Windows

Windows 8.1

Windows Rt 8.1

Windows Server 2012 R2

Referências · 8

• http://securitytracker.com/id/1034985 · Nota
• https://bdu.fstec.ru/vul/2016-00492 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0044 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-014 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0044 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms16-014 · Nota
• https://osv.dev/vulnerability/CVE-2016-0044 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/MS16-014 · Nota