PT-2016-2570 · Microsoft · Windows+1

Published 2016-08-09 · Updated 2018-10-12 · CVE-2016-3319

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version Microsoft Edge versions prior to the fixed version Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Microsoft Windows 10 Gold and 1511

Description The issue is related to the PDF library in Microsoft Windows and Microsoft Edge, which allows remote attackers to execute arbitrary code via a crafted PDF file. This is due to insufficient access control in the PDF library. The vulnerability can be exploited by a remote attacker to execute arbitrary code on the affected system. If the current user has administrative rights, an attacker could take control of the system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows 8.1, apply the fix for the Microsoft PDF Remote Code Execution Vulnerability. For Microsoft Windows Server 2012 Gold and R2, apply the fix for the Microsoft PDF Remote Code Execution Vulnerability. For Microsoft Windows 10 Gold and 1511, apply the fix for the Microsoft PDF Remote Code Execution Vulnerability. For Microsoft Edge, apply the fix for the Microsoft PDF Remote Code Execution Vulnerability. As a temporary workaround, consider restricting access to PDF files from untrusted sources until a patch is available.

Fix

RCE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2016-01962

CVE-2016-3319

Affected Products

Edge

Windows

References · 12

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-3319 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01962 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3319 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-096 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3319 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3319 · Security Note
• http://technet.microsoft.com/library/security/ms16-096 · Note
• https://technet.microsoft.com/library/security/MS16-096 · Note
• https://technet.microsoft.com/library/security/MS16-102 · Note
• http://securityfocus.com/bid/92293 · Note
• http://securitytracker.com/id/1036561 · Note