PT-2017-2325 · Microsoft · Windows Server 2016+6
Published
2017-06-13
·
Updated
2019-10-03
·
CVE-2017-8466
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Windows Cursor versions in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016
Description
The issue is related to insufficient access restrictions in the Windows Cursor component, allowing a local attacker to potentially elevate their privileges. This can lead to improper elevation of privilege, enabling an attacker to affect the system.
Recommendations
For Windows 8.1, consider restricting access to the Windows Cursor component until a patch is available.
For Windows Server 2012 Gold and R2, restrict the use of the Windows Cursor to minimize the risk of exploitation.
For Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016, avoid using the
NtUserLinkDpiCursor function in sensitive operations until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.LPE
Improper Preservation of Permissions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Windows
Windows 10
Windows 8.1
Windows Cursor
Windows Rt 8.1
Windows Server 2012
Windows Server 2016