PT-2016-1395 · Microsoft · Windows Server 2012 +7
B33F
+3
·
Published
2016-03-08
·
Updated
2025-04-07
·
CVE-2016-0099
7.2
High
| Base vector | Vector | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Microsoft Windows versions Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511
Description:
The Secondary Logon Service in Microsoft Windows does not properly process request handles, allowing local users to gain privileges via a crafted application. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator, then install programs, view, change, or delete data, or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system.
Recommendations:
For Microsoft Windows versions Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511, consider disabling the Secondary Logon Service as a temporary workaround until a patch is available. Restrict access to the system to minimize the risk of exploitation. Avoid using crafted applications that could exploit the vulnerability in the Secondary Logon Service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
LPE
Buffer Overflow
Related Identifiers
Affected Products
References · 21
- 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb⭐ 35019 🔗 14201 · Exploit
- 🔥 https://github.com/zcgonvh/MS16-032⭐ 81 🔗 43 · Exploit
- 🔥 https://exploit-db.com/exploits/40107 · Exploit
- 🔥 https://exploit-db.com/exploits/39809 · Exploit
- 🔥 https://exploit-db.com/exploits/39574 · Exploit
- 🔥 https://exploit-db.com/exploits/39719 · Exploit
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-032 · Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2016-0099 · Security Note
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0099 · Security Note
- https://bdu.fstec.ru/vul/2016-00694 · Security Note
- https://t.me/cvenotify/118083 · Telegram Post
- https://t.me/cvenotify/110615 · Telegram Post
- https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
- https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
- https://t.me/cvenotify/87241 · Telegram Post