PT-2017-1630 · Microsoft · Windows Media Player+9

Abdulrahman Alqabandi + 1 · Publicado 2017-03-14 · Atualizado 2017-07-12 · CVE-2017-0042

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version Windows Media Player in Microsoft Windows 8.1 Windows Media Player in Microsoft Windows Server 2012 R2 Windows Media Player in Microsoft Windows RT 8.1 Windows Media Player in Microsoft Windows 7 SP1 Windows Media Player in Microsoft Windows 2008 SP2 and R2 SP1 Windows Media Player in Microsoft Windows Server 2016 Windows Media Player in Microsoft Windows Vista SP2 Windows Media Player in Microsoft Windows 10 Gold, 1511, and 1607

Description The issue allows remote attackers to obtain sensitive information via a crafted web site. This is related to the lack of protection for service data, which can be exploited by a remote attacker to gain confidential information using a specially formed website.

Recommendations For Microsoft Windows 8.1, update to a version that includes the fix for this issue. For Microsoft Windows Server 2012 R2, update to a version that includes the fix for this issue. For Microsoft Windows RT 8.1, update to a version that includes the fix for this issue. For Microsoft Windows 7 SP1, update to a version that includes the fix for this issue. For Microsoft Windows 2008 SP2 and R2 SP1, update to a version that includes the fix for this issue. For Microsoft Windows Server 2016, update to a version that includes the fix for this issue. For Microsoft Windows Vista SP2, update to a version that includes the fix for this issue. For Microsoft Windows 10 Gold, 1511, and 1607, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to Windows Media Player until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2017-00783

CVE-2017-0042

Produtos afetados

Windows

Windows 10

Windows 2008

Windows 7

Windows 8.1

Windows Media Player

Windows Rt 8.1

Windows Server 2012 R2

Windows Server 2016

Windows Vista

Referências · 10

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-0042 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-0042 · Nota de Segurança
• http://pastebin.com/raw/Eztknq4s · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0042 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-0042 · Aviso do Fabricante
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0042 · Aviso do Fabricante
• http://securitytracker.com/id/1038016 · Nota
• https://bdu.fstec.ru/vul/2017-00783 · Nota de Segurança
• http://securityfocus.com/bid/96098 · Nota
• https://twitter.com/Qab/status/842506404950917120 · Nota