PT-2016-2916 · Microsoft · Windows Server 2016+5

Published 2016-11-08 · Updated 2018-10-12 · CVE-2016-7247

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8.1, 10 (Gold, 1511, 1607), Windows Server 2012 (Gold and R2), Windows Server 2016, and Windows RT 8.1

Description The issue is related to insufficient access control in the Windows operating system, allowing attackers to bypass the Secure Boot protection mechanism. This can be achieved by exploiting the vulnerability with a crafted boot policy, potentially enabling remote attackers to affect the system.

Recommendations For Microsoft Windows versions 8.1, 10 (Gold, 1511, 1607), Windows Server 2012 (Gold and R2), Windows Server 2016, and Windows RT 8.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2016-02347

CVE-2016-7247

Affected Products

Windows

Windows 10

Windows 8.1

Windows Rt 8.1

Windows Server 2012

Windows Server 2016

References · 10

• https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05340049 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-02347 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7247 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7247 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-140 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7247 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-7247 · Vendor Advisory
• http://securityfocus.com/bid/94058 · Note
• http://securitytracker.com/id/1037255 · Note
• http://technet.microsoft.com/security/bulletin/MS16-140 · Note