PT-2016-2916 · Microsoft · Windows Server 2016+5

Publicado 2016-11-08 · Atualizado 2018-10-12 · CVE-2016-7247

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8.1, 10 (Gold, 1511, 1607), Windows Server 2012 (Gold and R2), Windows Server 2016, and Windows RT 8.1

Description The issue is related to insufficient access control in the Windows operating system, allowing attackers to bypass the Secure Boot protection mechanism. This can be achieved by exploiting the vulnerability with a crafted boot policy, potentially enabling remote attackers to affect the system.

Recommendations For Microsoft Windows versions 8.1, 10 (Gold, 1511, 1607), Windows Server 2012 (Gold and R2), Windows Server 2016, and Windows RT 8.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2016-02347

CVE-2016-7247

Produtos afetados

Windows

Windows 10

Windows 8.1

Windows Rt 8.1

Windows Server 2012

Windows Server 2016

Referências · 10

• https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05340049 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-02347 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-7247 · Aviso do Fabricante
• http://securityfocus.com/bid/94058 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7247 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-140 · Aviso do Fabricante
• http://securitytracker.com/id/1037255 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-140 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7247 · Nota de Segurança
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-7247 · Aviso do Fabricante