PT-2017-1595 · Microsoft · Windows

Mateusz Jurczyk · Publicado 2017-03-14 · Atualizado 2017-08-16 · CVE-2017-0063

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows versions prior to the fixed version

Description The issue is related to the Color Management Module (ICM32.dll) in Windows, which lacks protection of internal data. This can be exploited by a remote attacker through a crafted website, potentially allowing them to bypass security features and execute code, or cause a denial of service. The estimated number of potentially affected devices and details about real-world incidents are not specified.

Recommendations For Windows Vista SP2, Windows Server 2008 SP2 and R2, and Windows 7 SP1, update to a version that includes the fix for this issue. For Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the ICM32.dll module until a patch is available.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2017-00740

CVE-2017-0063

Produtos afetados

Windows

Referências · 9

• 🔥 https://exploit-db.com/exploits/41659 · Exploit
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0063 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00740 · Nota de Segurança
• http://securityfocus.com/bid/96643 · Nota
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-0063 · Aviso do Fabricante
• http://securitytracker.com/id/1038002 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0063 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-0063 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-0063 · Aviso do Fabricante