PT-2017-1650 · Microsoft · Windows Server 2016+10

Hossein Lotfi · Published 2017-03-14 · Updated 2019-10-03 · CVE-2017-0014

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office 2010 SP2 Windows Server 2008 R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 versions Gold, 1511, and 1607 Windows Server 2016

Description The issue is related to insufficient access control in the Windows Graphics Component, which can be exploited by a remote attacker to execute arbitrary code via a specially crafted web site. This can allow the attacker to take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system may be less impacted than those operating with administrative user rights.

Recommendations For Microsoft Office 2010 SP2, update to a version that includes the fix for this issue. For Windows Server 2008 R2 SP1, apply the recommended security update. For Windows 7 SP1, install the latest security patch. For Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 versions Gold, 1511, and 1607, and Windows Server 2016, apply the respective security updates to resolve the issue. As a temporary workaround, consider restricting access to the Windows Graphics Component until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2017-00803

CVE-2017-0014

Affected Products

Office 2010

Office

Windows

Windows 10

Windows 7

Windows 8.1

Windows Graphics

Windows Rt 8.1

Windows Server 2008 R2

Windows Server 2012

Windows Server 2016

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2017-0014 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0014 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-0014 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0014 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0014 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00803 · Security Note
• http://securityfocus.com/bid/96013 · Note
• http://technet.microsoft.com/library/security/MS17-013 · Note
• https://secuniaresearch.flexerasoftware.com/secunia_research/2017-9 · Note
• http://securitytracker.com/id/1038002 · Note