PT-2016-1379 · Microsoft · Windows Rt 8.1+4

Published 2016-03-08 · Updated 2018-10-12 · CVE-2016-0117

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8.1, 10 Gold, 10 1511, Windows Server 2012 Gold and R2, Windows RT 8.1

Description The issue allows remote attackers to execute arbitrary code via a crafted PDF document. This is due to insufficient input validation in the PDF library. An attacker who successfully exploits the issue could cause arbitrary code to execute in the context of the current user. If a user is logged on with administrative user rights, an attacker could take control of the affected system, then install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows versions 8.1, 10 Gold, 10 1511, Windows Server 2012 Gold and R2, Windows RT 8.1, avoid opening specially crafted .pdf files until a patch is available. As a temporary workaround, consider restricting the use of the PDF library until a fix is provided. Restrict access to administrative user rights to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00678

CVE-2016-0117

Affected Products

Windows

Windows 10

Windows 8.1

Windows Rt 8.1

Windows Server 2012

References · 9

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-028 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00678 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-0117 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0117 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0117 · Security Note
• http://technet.microsoft.com/library/security/ms16-028 · Note
• http://technet.microsoft.com/security/bulletin/MS16-028 · Note
• http://securitytracker.com/id/1035202 · Note
• http://securityfocus.com/bid/84109 · Note