PT-2016-2187 · Microsoft · Internet Explorer+8

Publicado 2016-06-14 · Atualizado 2018-10-12 · CVE-2016-3213

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511 Internet Explorer versions 9 through 11

Description The Web Proxy Auto Discovery (WPAD) protocol implementation has an improper fallback mechanism, allowing remote attackers to gain privileges via NetBIOS name responses. This issue is related to insufficient access control in the WPAD protocol implementation in Windows and Internet Explorer, which can be exploited by a remote attacker to elevate their privileges. An elevation-of-privilege vulnerability exists when the WPAD protocol falls back to a vulnerable proxy discovery process, allowing an attacker to bypass security and gain elevated privileges on a targeted system.

Recommendations For Microsoft Windows versions Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, consider disabling the WPAD protocol as a temporary workaround until a patch is available. For Internet Explorer versions 9 through 11, restrict access to the NetBIOS name response mechanism to minimize the risk of exploitation. As a general mitigation measure, ensure that the WPAD protocol is properly configured and consider implementing additional security controls to prevent elevation-of-privilege attacks.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2016-01540

CVE-2016-3213

Produtos afetados

Internet Explorer

Windows

Windows 10

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2012

Windows Vista

Referências · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/netbios_spoof_nat.rb · Exploit
• http://securitytracker.com/id/1036104 · Nota
• https://osv.dev/vulnerability/CVE-2016-3213 · Aviso do Fabricante
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-3213 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-01540 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-077 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/MS16-063 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-3213 · Nota de Segurança
• http://securitytracker.com/id/1036096 · Nota
• http://technet.microsoft.com/library/security/ms16-063 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3213 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/MS16-077 · Nota