PT-2016-1394 · Microsoft · Windows Server 2008 R2 Sp1+5

Publicado 2016-03-09 · Atualizado 2018-10-12 · CVE-2016-0101

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Server 2008 R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold and 1511

Description The issue allows remote attackers to execute arbitrary code via crafted media content. This is due to insufficient input validation in the Windows operating system. Exploitation of the issue may allow a remote attacker to execute arbitrary code using specially crafted media content.

Recommendations For Windows Server 2008 R2 SP1, update to a newer version to mitigate the risk. For Windows 7 SP1, update to a newer version to mitigate the risk. For Windows 8.1, update to a newer version to mitigate the risk. For Windows Server 2012 Gold and R2, update to a newer version to mitigate the risk. For Windows RT 8.1, update to a newer version to mitigate the risk. For Windows 10 Gold and 1511, update to a newer version to mitigate the risk.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-00693

CVE-2016-0101

Produtos afetados

Windows 10

Windows 7 Sp1

Windows 8.1

Windows Rt 8.1

Windows Server 2008 R2 Sp1

Windows Server 2012

Referências · 7

• https://bdu.fstec.ru/vul/2016-00693 · Nota de Segurança
• http://securityfocus.com/bid/84111 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-027 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0101 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/MS16-027 · Nota
• https://osv.dev/vulnerability/CVE-2016-0101 · Aviso do Fabricante
• http://securitytracker.com/id/1035200 · Nota