PT-2017-2793 · Microsoft · Windows Rt 8.1+5

Published 2017-09-12 · Updated 2019-10-03 · CVE-2017-8628

Positive Technologies (AI Summary)

CVSS v2.0

7.9

High

Base vector

AV:A/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Server 2008 SP2 Windows 7 SP1 Windows 8.1 Windows RT 8.1 Windows 10 versions 1511 through 1703

Description The issue is related to the implementation of the Bluetooth protocol in Windows operating systems, specifically concerning incorrect security requirements. This allows a remote attacker to create a network interface and potentially conduct a "man-in-the-middle" attack. The vulnerability can be exploited by attackers to affect the system.

Recommendations For Windows Server 2008 SP2, update the system to apply the necessary security patches. For Windows 7 SP1, apply the available security update to resolve the issue. For Windows 8.1 and Windows RT 8.1, install the latest security patch to fix the vulnerability. For Windows 10 versions 1511 through 1703, update to a newer version of Windows 10 that includes the security fix.

Fix

Weakness Enumeration

CWE-300

Related Identifiers

BDU:2017-02056

CVE-2017-8628

Affected Products

Windows

Windows 10

Windows 7 Sp1

Windows 8.1

Windows Rt 8.1

Windows Server 2008 R2

References · 8

• https://osv.dev/vulnerability/CVE-2017-8628 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8628 · Security Note
• https://bdu.fstec.ru/vul/2017-02056 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8628 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-8628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8628 · Security Note
• http://securitytracker.com/id/1039339 · Note
• http://securityfocus.com/bid/100744 · Note