PT-2017-1657 · Microsoft · Windows

Publicado 2017-03-14 · Atualizado 2025-04-04 · CVE-2017-0005

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is related to the Graphics Device Interface (GDI) in Windows, which has insufficient access restrictions. This can be exploited by a local attacker to gain elevated privileges using a specially crafted application. The vulnerability has been reportedly used in real-world attacks, with estimated targets including government, transport, energy, maritime, military, and financial institutions.

Recommendations For Microsoft Windows versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the GDI interface until a patch is available. Avoid using the vulnerable GDI functions in the affected Windows versions until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2017-00810

CVE-2017-0005

Produtos afetados

Windows

Referências · 29

• 🔥 https://github.com/sheri31/0005poc · Exploit
• 🔥 https://blogs.technet.microsoft.com/mmpc/2017/03/27/detecting-and-mitigating-elevation-of-privilege-exploit-for-cve-2017-0005 · Exploit
• https://github.com/nmap/nmap · Nota
• https://github.com/Marten4n6/EvilOSX · Nota
• https://github.com/m0n0ph1/malware-1 · Nota
• https://github.com/HarfangLab/iocs · Nota
• https://t.me/cvenotify/110011 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-0005 · Aviso do Fabricante
• https://t.me/aptreports/11828 · Publicação no Telegram
• http://securitytracker.com/id/1038002 · Nota
• https://bdu.fstec.ru/vul/2017-00810 · Nota de Segurança
• https://t.me/cybersecuritytechnologies/2807 · Publicação no Telegram
• https://github.com/willbill4/workspaceer · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0005 · Aviso do Fabricante
• https://t.me/cvenotify/110594 · Publicação no Telegram