PT-2017-12273 · Microsoft · Windows Server 2012 R2+6

Published 2017-11-14 · Updated 2022-05-23 · CVE-2017-11850

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 versions 1511 through 1709 Windows Server 2016 and Windows Server, version 1709

Description The issue is related to improper handling of objects in memory, allowing an attacker to run a specially crafted application on an affected system. This can potentially lead to sensitive information disclosure.

Recommendations For Windows 8.1 and RT 8.1, update to a newer version to mitigate the risk. For Windows Server 2012 and R2, apply the recommended security updates. For Windows 10 versions 1511 through 1709, install the latest cumulative update. For Windows Server 2016 and Windows Server, version 1709, apply the necessary patches. As a temporary workaround, consider restricting access to sensitive system resources until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-11850

Affected Products

Windows

Windows 10

Windows 8.1

Windows Rt 8.1

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11850 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-11850 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11850 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11850 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11850 · Security Note
• http://securitytracker.com/id/1039782 · Note
• http://securityfocus.com/bid/101738 · Note