PT-2017-2178 · Microsoft · Windows Server 2016+10

Nixawk + 1 · Published 2017-06-13 · Updated 2025-04-08 · CVE-2017-8464

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Shell versions in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016

Description The issue is related to errors in handling .LNK files, which can allow local users or remote attackers to execute arbitrary code. This can occur when a crafted .LNK file is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. Exploitation of this issue may enable an attacker to execute arbitrary code by connecting to a system with a specially crafted shortcut associated with a malicious application. After viewing the storage device using any application that performs icon parsing, arbitrary code will be executed.

Recommendations For Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016, consider disabling the handling of .LNK files in Windows Explorer or other applications that parse shortcut icons until a patch is available. As a temporary workaround, restrict access to removable storage devices to minimize the risk of exploitation. Avoid using applications that parse and display icons of shortcuts from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2017-01371

CVE-2017-8464

Affected Products

Windows

Windows 10

Windows 7

Windows 8

Windows 8.1

Windows Explorer

Windows Rt 8.1

Windows Server 2008

Windows Server 2012

Windows Server 2016

Windows Shell

References · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-8464.md · Exploit
• 🔥 https://github.com/3gstudent/CVE-2017-8464-EXP · Exploit
• 🔥 https://github.com/doudouhala/CVE-2017-8464-exp-generator · Exploit
• 🔥 https://github.com/Securitykid/CVE-2017-8464-exp-generator · Exploit
• 🔥 https://github.com/Elm0D/CVE-2017-8464 · Exploit
• 🔥 https://exploit-db.com/exploits/42382 · Exploit
• 🔥 https://exploit-db.com/exploits/42429 · Exploit
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8464 · Security Note
• https://bdu.fstec.ru/vul/2017-01371 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8464 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-8464 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8464 · Security Note