PT-2016-1688 · Microsoft · Windows 10+1

Publicado 2016-04-12 · Atualizado 2018-10-12 · CVE-2016-0150

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Windows 10 versions Gold and 1511

Description The issue is related to the improper handling of data by the HTTP.sys component in the Windows operating system. It can be exploited by a remote attacker using specially crafted HTTP 2.0 requests, potentially causing a denial of service (system hang).

Recommendations For Windows 10 versions Gold and 1511, consider restricting access to the HTTP.sys component to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

BDU:2016-01014

CVE-2016-0150

Produtos afetados

Windows

Windows 10

Referências · 8

• https://bdu.fstec.ru/vul/2016-01014 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/MS16-049 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0150 · Nota de Segurança
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-0150 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-0150 · Aviso do Fabricante
• http://securitytracker.com/id/1035546 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0150 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-049 · Aviso do Fabricante