PT-2017-2477 · Microsoft · Windows Server 2008+7
Published
2017-07-11
·
Updated
2019-10-03
·
CVE-2017-8589
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows versions prior to the fixed version, including Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 versions prior to the fixed version, including Gold, 1511, 1607, 1703, and Windows Server 2016
Description
The issue is related to the way Windows Search handles objects in memory, allowing a remote code execution. This can be exploited by a remote attacker to execute arbitrary code on the system.
Recommendations
For Windows 7 SP1, update to a version that includes the fix for this issue.
For Windows Server 2008 SP2 and R2 SP1, update to a version that includes the fix for this issue.
For Windows 8.1 and Windows RT 8.1, update to a version that includes the fix for this issue.
For Windows Server 2012 and R2, update to a version that includes the fix for this issue.
For Windows 10 Gold, 1511, 1607, 1703, update to a version that includes the fix for this issue.
For Windows Server 2016, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the Windows Search component until a patch is available.
Fix
RCE
Improper Preservation of Permissions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Windows
Windows 10
Windows 7
Windows 8.1
Windows Rt 8.1
Windows Server 2008
Windows Server 2012
Windows Server 2016