PT-2016-1998 · Microsoft · Windows Vista+6

Publicado 2016-05-10 · Atualizado 2018-10-12 · CVE-2016-0182

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Journal versions in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold and 1511

Description The issue is related to insufficient access control in the Windows Journal component, allowing remote attackers to execute arbitrary code by using a specially crafted Journal file. This can affect the system, enabling the execution of arbitrary code.

Recommendations For Windows Journal in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold and 1511, consider restricting access to the Journal component until a patch is available. As a temporary workaround, avoid using the Windows Journal component to open specially crafted Journal files until the issue is resolved.

Correção

RCE

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2016-01332

CVE-2016-0182

Produtos afetados

Windows

Windows 10

Windows 7

Windows 8.1

Windows Journal

Windows Rt 8.1

Windows Vista

Referências · 10

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-0182 · Aviso do Fabricante
• https://verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1225 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0182 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0182 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-056 · Aviso do Fabricante
• http://securitytracker.com/id/1035824 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-056 · Nota
• https://osv.dev/vulnerability/CVE-2016-0182 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-01332 · Nota de Segurança
• http://securityfocus.com/bid/89867 · Nota