PT-2016-2758 · Microsoft · Windows Rt 8.1+4

Published 2016-09-13 · Updated 2019-05-16 · CVE-2016-3302

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8.1, 10 Gold, 10 1511, 10 1607, Windows Server 2012 R2, Windows RT 8.1

Description The issue is related to the incorrect restriction of web content loading when the lock screen is enabled, allowing a local attacker to execute arbitrary code using a specially crafted Wi-Fi access point or mobile-broadband device. This can lead to an elevation of privilege.

Recommendations For Microsoft Windows versions 8.1, 10 Gold, 10 1511, 10 1607, Windows Server 2012 R2, Windows RT 8.1, consider disabling the lock screen feature until a patch is available to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2016-02160

CVE-2016-3302

Affected Products

Windows

Windows 10

Windows 8.1

Windows Rt 8.1

Windows Server 2012 R2

References · 9

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3302 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3302 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-3302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3302 · Security Note
• https://bdu.fstec.ru/vul/2016-02160 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-112 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/MS16-112 · Note
• http://securityfocus.com/bid/92853 · Note
• http://securitytracker.com/id/1036799 · Note