PT-2016-1688 · Microsoft · Windows 10+1

Published 2016-04-12 · Updated 2018-10-12 · CVE-2016-0150

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Windows 10 versions Gold and 1511

Description The issue is related to the improper handling of data by the HTTP.sys component in the Windows operating system. It can be exploited by a remote attacker using specially crafted HTTP 2.0 requests, potentially causing a denial of service (system hang).

Recommendations For Windows 10 versions Gold and 1511, consider restricting access to the HTTP.sys component to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-19

Related Identifiers

BDU:2016-01014

CVE-2016-0150

Affected Products

Windows

Windows 10

References · 8

• https://bdu.fstec.ru/vul/2016-01014 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-0150 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-0150 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-0150 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0150 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-049 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/MS16-049 · Note
• http://securitytracker.com/id/1035546 · Note