PT-2017-2383 · Microsoft · Windows+1

Publicado 2017-06-13 · Atualizado 2019-10-03 · CVE-2017-0292

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows versions 8.1, 10 (including 1511, 1607, 1703), and Windows Server versions 2012 (including Gold and R2), 2016 Microsoft Word versions 2013, 2016

Description The issue is related to insufficient access control in Windows and Microsoft Word, allowing remote code execution when a user opens a specially crafted PDF file. This could enable an attacker to execute arbitrary code in the context of the current user. The exploitation involves enticing the user to open a malicious PDF file.

Recommendations For Windows versions 8.1, 10 (including 1511, 1607, 1703), and Windows Server versions 2012 (including Gold and R2), 2016, update to a version that includes the fix for this issue. For Microsoft Word versions 2013, 2016, avoid opening specially crafted PDF files until a patch is applied. As a temporary workaround, consider restricting the use of PDF files from untrusted sources to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2017-01586

CVE-2017-0292

ZDI-17-397

Produtos afetados

Office Word

Windows

Referências · 9

• https://osv.dev/vulnerability/CVE-2017-0292 · Aviso do Fabricante
• http://securitytracker.com/id/1038678 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0292 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-0292 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0292 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-01586 · Nota de Segurança
• http://securityfocus.com/bid/98836 · Nota
• https://zerodayinitiative.com/advisories/ZDI-17-397 · Nota de Segurança
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-0292 · Aviso do Fabricante