PT-2016-2001 · Microsoft · Windows Server 2012 R2+5

Publicado 2016-05-10 · Atualizado 2018-10-12 · CVE-2016-0179

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Shell versions in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511

Description The issue is related to insufficient access control in the Windows Shell component of the Windows operating system. It allows a remote attacker to execute arbitrary code by using a specially crafted website. This can potentially affect the system.

Recommendations For Windows Shell in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511, consider restricting access to the Windows Shell until a patch is available. As a temporary workaround, avoid using specially crafted websites that could exploit the vulnerability in the Windows Shell component.

Correção

RCE

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2016-01335

CVE-2016-0179

Produtos afetados

Windows

Windows 10

Windows 8.1

Windows Rt 8.1

Windows Server 2012 R2

Windows Shell

Referências · 9

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-057 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0179 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/MS16-057 · Nota
• http://securityfocus.com/bid/89868 · Nota
• http://securitytracker.com/id/1035825 · Nota
• https://bdu.fstec.ru/vul/2016-01335 · Nota de Segurança
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-0179 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-0179 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0179 · Nota de Segurança