PT-2017-18370 · Microsoft · Windows Server 2016+9

Publicado

2017-07-11

·

Atualizado

2017-07-17

·

CVE-2017-8486

CVSS v3.1

4.7

Média

VetorAV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 7 SP1, 8.1, 10 Gold, 1511, 1607, 1703 Microsoft Windows Server versions 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016 Windows RT 8.1
Description The issue allows attackers to obtain sensitive information and affect the system due to the way it handles objects in memory. This is related to an out-of-bounds read information disclosure in the win32kfull CopyOutputString.
Recommendations For Microsoft Windows versions 7 SP1, 8.1, 10 Gold, 1511, 1607, 1703, update to a version that includes the fix for the information disclosure issue. For Microsoft Windows Server versions 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, update to a version that includes the fix for the information disclosure issue. For Windows RT 8.1, update to a version that includes the fix for the information disclosure issue. As a temporary workaround, consider restricting access to sensitive information until a patch is available.

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-8486
ZDI-17-471

Produtos afetados

Windows
Windows 10
Windows 7
Windows 8.1
Windows Rt 8.1
Windows Server 2008
Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Windows Server 2016