PT-2016-3132 · Microsoft · Windows 7+3

Publicado 2016-03-08 · Atualizado 2018-10-12 · CVE-2016-0087

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1

Description The issue is related to insufficient validation of handles in the Windows operating system. This could allow a local attacker to elevate their privileges using a specially crafted application. An attacker who successfully exploits the issue could run arbitrary code as System, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. To exploit the issue, an attacker would first have to log on to the system.

Recommendations For Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to sensitive system resources to minimize the risk of exploitation. Avoid using the system with elevated privileges until the issue is resolved.

Correção

LPE

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2017-01324

CVE-2016-0087

Produtos afetados

Windows

Windows 7

Windows Server 2008

Windows Vista

Referências · 9

• http://securitytracker.com/id/1035209 · Nota
• http://technet.microsoft.com/library/security/ms16-031 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-031 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-01324 · Nota de Segurança
• http://securityfocus.com/bid/84032 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-031 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0087 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0087 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-0087 · Aviso do Fabricante