PT-2017-2327 · Microsoft · Windows Server+1

Published 2017-06-13 · Updated 2019-10-03 · CVE-2017-8468

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8.1 through 10 version 1703 Microsoft Windows Server versions 2012 R2 through 2016

Description The issue is related to the Windows kernel improperly handling objects in memory, allowing an attacker to run processes in an elevated context. This can enable a local attacker to gain access to process management in a privileged context. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For Microsoft Windows versions 8.1 through 10 version 1703, update to a version that properly handles objects in memory to prevent elevation of privilege. For Microsoft Windows Server versions 2012 R2 through 2016, apply the necessary patch to fix the improper handling of objects in memory. As a temporary workaround, consider restricting access to sensitive system resources until a patch is available.

Fix

LPE

Improper Preservation of Permissions

Weakness Enumeration

CWE-264

CWE-281

Related Identifiers

BDU:2017-01525

CVE-2017-8468

ZDI-17-403

Affected Products

Windows

Windows Server

References · 8

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8468 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-403 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8468 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8468 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-8468 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8468 · Security Note
• https://bdu.fstec.ru/vul/2017-01525 · Security Note
• http://securityfocus.com/bid/98846 · Note