PT-2017-1650 · Microsoft · Windows Server 2016+10

Hossein Lotfi · Publicado 2017-03-14 · Atualizado 2019-10-03 · CVE-2017-0014

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office 2010 SP2 Windows Server 2008 R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 versions Gold, 1511, and 1607 Windows Server 2016

Description The issue is related to insufficient access control in the Windows Graphics Component, which can be exploited by a remote attacker to execute arbitrary code via a specially crafted web site. This can allow the attacker to take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system may be less impacted than those operating with administrative user rights.

Recommendations For Microsoft Office 2010 SP2, update to a version that includes the fix for this issue. For Windows Server 2008 R2 SP1, apply the recommended security update. For Windows 7 SP1, install the latest security patch. For Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 versions Gold, 1511, and 1607, and Windows Server 2016, apply the respective security updates to resolve the issue. As a temporary workaround, consider restricting access to the Windows Graphics Component until a patch is available.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2017-00803

CVE-2017-0014

Produtos afetados

Office 2010

Office

Windows

Windows 10

Windows 7

Windows 8.1

Windows Graphics

Windows Rt 8.1

Windows Server 2008 R2

Windows Server 2012

Windows Server 2016

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2017-0014 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0014 · Nota de Segurança
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-0014 · Aviso do Fabricante
• http://securityfocus.com/bid/96013 · Nota
• http://technet.microsoft.com/library/security/MS17-013 · Nota
• https://secuniaresearch.flexerasoftware.com/secunia_research/2017-9 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0014 · Aviso do Fabricante
• http://securitytracker.com/id/1038002 · Nota
• https://osv.dev/vulnerability/CVE-2017-0014 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00803 · Nota de Segurança