PT-2017-1657 · Microsoft · Windows

Published 2017-03-14 · Updated 2025-04-04 · CVE-2017-0005

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is related to the Graphics Device Interface (GDI) in Windows, which has insufficient access restrictions. This can be exploited by a local attacker to gain elevated privileges using a specially crafted application. The vulnerability has been reportedly used in real-world attacks, with estimated targets including government, transport, energy, maritime, military, and financial institutions.

Recommendations For Microsoft Windows versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the GDI interface until a patch is available. Avoid using the vulnerable GDI functions in the affected Windows versions until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2017-00810

CVE-2017-0005

Affected Products

Windows

References · 29

• 🔥 https://github.com/sheri31/0005poc · Exploit
• 🔥 https://blogs.technet.microsoft.com/mmpc/2017/03/27/detecting-and-mitigating-elevation-of-privilege-exploit-for-cve-2017-0005 · Exploit
• https://osv.dev/vulnerability/CVE-2017-0005 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00810 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0005 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-0005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0005 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0005 · Security Note
• https://github.com/nmap/nmap · Note
• https://github.com/Marten4n6/EvilOSX · Note
• https://github.com/m0n0ph1/malware-1 · Note
• https://github.com/HarfangLab/iocs · Note
• https://t.me/cvenotify/110011 · Telegram Post
• https://t.me/aptreports/11828 · Telegram Post
• http://securitytracker.com/id/1038002 · Note