PT-2016-1394 · Microsoft · Windows Server 2008 R2 Sp1+5

Published 2016-03-09 · Updated 2018-10-12 · CVE-2016-0101

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Server 2008 R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold and 1511

Description The issue allows remote attackers to execute arbitrary code via crafted media content. This is due to insufficient input validation in the Windows operating system. Exploitation of the issue may allow a remote attacker to execute arbitrary code using specially crafted media content.

Recommendations For Windows Server 2008 R2 SP1, update to a newer version to mitigate the risk. For Windows 7 SP1, update to a newer version to mitigate the risk. For Windows 8.1, update to a newer version to mitigate the risk. For Windows Server 2012 Gold and R2, update to a newer version to mitigate the risk. For Windows RT 8.1, update to a newer version to mitigate the risk. For Windows 10 Gold and 1511, update to a newer version to mitigate the risk.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00693

CVE-2016-0101

Affected Products

Windows 10

Windows 7 Sp1

Windows 8.1

Windows Rt 8.1

Windows Server 2008 R2 Sp1

Windows Server 2012

References · 7

• https://bdu.fstec.ru/vul/2016-00693 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0101 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0101 · Vendor Advisory
• http://securityfocus.com/bid/84111 · Note
• http://technet.microsoft.com/security/bulletin/MS16-027 · Note
• http://securitytracker.com/id/1035200 · Note