PT-2016-2917 · Microsoft · Windows Server 2008 R2 Sp1+7
Publicado
2016-11-08
·
Atualizado
2018-10-12
·
CVE-2016-7246
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows Server 2008 R2 SP1
Microsoft Windows 7 SP1
Microsoft Windows 8.1
Microsoft Windows Server 2012 Gold and R2
Microsoft Windows RT 8.1
Microsoft Windows 10 versions Gold through 1607
Microsoft Windows Server 2016
Description
The issue is related to a kernel-mode driver in Microsoft Windows, which is associated with insufficient access restrictions. This allows a local attacker to gain elevated privileges using a specially crafted application. The vulnerability can be exploited to corrupt kernel state information, leading to privilege escalation.
Recommendations
For Microsoft Windows Server 2008 R2 SP1, update to a newer version to mitigate the risk.
For Microsoft Windows 7 SP1, update to a newer version to mitigate the risk.
For Microsoft Windows 8.1, update to a newer version to mitigate the risk.
For Microsoft Windows Server 2012 Gold and R2, update to a newer version to mitigate the risk.
For Microsoft Windows RT 8.1, update to a newer version to mitigate the risk.
For Microsoft Windows 10 versions Gold through 1607, update to a version newer than 1607 to mitigate the risk.
For Microsoft Windows Server 2016, update to a newer version to mitigate the risk.
As a temporary workaround, consider restricting access to the
NtUserMagSetContextInformation function until a patch is available.Correção
LPE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Windows
Windows 10
Windows 7 Sp1
Windows 8.1
Windows Rt 8.1
Windows Server 2008 R2 Sp1
Windows Server 2012
Windows Server 2016