PT-2017-2325 · Microsoft · Windows Server 2016+6
Publicado
2017-06-13
·
Atualizado
2019-10-03
·
CVE-2017-8466
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Windows Cursor versions in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016
Description
The issue is related to insufficient access restrictions in the Windows Cursor component, allowing a local attacker to potentially elevate their privileges. This can lead to improper elevation of privilege, enabling an attacker to affect the system.
Recommendations
For Windows 8.1, consider restricting access to the Windows Cursor component until a patch is available.
For Windows Server 2012 Gold and R2, restrict the use of the Windows Cursor to minimize the risk of exploitation.
For Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016, avoid using the
NtUserLinkDpiCursor function in sensitive operations until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.LPE
Improper Preservation of Permissions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Windows
Windows 10
Windows 8.1
Windows Cursor
Windows Rt 8.1
Windows Server 2012
Windows Server 2016