PT-2017-2303 · Microsoft · Windows Server 2016+14

0Vercl0K + 2 · Published 2017-06-13 · Updated 2019-10-03 · CVE-2017-0283

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold, 1511, 1607 Windows Server 2016 Microsoft Office 2007 SP3 Microsoft Office 2010 SP2 Microsoft Office Word Viewer Microsoft Lync 2013 SP1 Skype for Business 2016 Microsoft Silverlight 5 Developer Runtime when installed on Microsoft Windows Microsoft Silverlight 5 when installed on Microsoft Windows

Description The issue is related to the way Windows Uniscribe handles objects in memory, allowing a remote code execution. This could enable an attacker to take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights.

Recommendations For Windows Server 2008 SP2 and R2 SP1, consider applying security updates to address the issue. For Windows 7 SP1, apply the latest security patches to mitigate the risk. For Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016, ensure all latest updates are installed. For Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office Word Viewer, Microsoft Lync 2013 SP1, and Skype for Business 2016, apply the latest security updates. For Microsoft Silverlight 5 Developer Runtime and Microsoft Silverlight 5, ensure you have the latest version installed and consider disabling unnecessary features until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2017-01501

CVE-2017-0283

Affected Products

Lync 2013

Office 2007

Office 2010

Office Word Viewer

Silverlight 5

Office

Skype For Business 2016

Windows

Windows 10

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2012

Windows Server 2016

References · 12

• 🔥 https://0patch.blogspot.tw/2017/07/0patching-quick-brown-fox-of-cve-2017.html · Exploit
• 🔥 https://exploit-db.com/exploits/42234 · Exploit
• https://osv.dev/vulnerability/CVE-2017-0283 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01501 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0283 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0283 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-0283 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-0283 · Vendor Advisory
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1198 · Note
• http://securityfocus.com/bid/98920 · Note
• http://securitytracker.com/id/1038675 · Note
• https://0patch.blogspot.com/2017/07/0patching-quick-brown-fox-of-cve-2017.html · Note