PT-2016-2758 · Microsoft · Windows Rt 8.1+4

Publicado 2016-09-13 · Atualizado 2019-05-16 · CVE-2016-3302

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8.1, 10 Gold, 10 1511, 10 1607, Windows Server 2012 R2, Windows RT 8.1

Description The issue is related to the incorrect restriction of web content loading when the lock screen is enabled, allowing a local attacker to execute arbitrary code using a specially crafted Wi-Fi access point or mobile-broadband device. This can lead to an elevation of privilege.

Recommendations For Microsoft Windows versions 8.1, 10 Gold, 10 1511, 10 1607, Windows Server 2012 R2, Windows RT 8.1, consider disabling the lock screen feature until a patch is available to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2016-02160

CVE-2016-3302

Produtos afetados

Windows

Windows 10

Windows 8.1

Windows Rt 8.1

Windows Server 2012 R2

Referências · 9

• http://technet.microsoft.com/security/bulletin/MS16-112 · Nota
• http://securityfocus.com/bid/92853 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3302 · Nota de Segurança
• http://securitytracker.com/id/1036799 · Nota
• https://osv.dev/vulnerability/CVE-2016-3302 · Aviso do Fabricante
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-3302 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3302 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-02160 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-112 · Aviso do Fabricante