PT-2017-2915 · Microsoft · Windows Server+1

Published 2017-09-11 · Updated 2017-09-19 · CVE-2017-8686

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Server versions 2012 Gold and R2 through 2016

Description The issue is caused by a memory corruption vulnerability in the Windows Server DHCP service, allowing an attacker to either run arbitrary code on the DHCP failover server or cause the DHCP service to become nonresponsive. This can be exploited by remote attackers to execute arbitrary code and affect the system.

Recommendations For Windows Server 2012 Gold and R2, and Windows Server 2016, update to a version that includes the fix for the memory corruption vulnerability in the Windows Server DHCP service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-02240

CVE-2017-8686

Affected Products

Windows

Windows Server

References · 8

• https://osv.dev/vulnerability/CVE-2017-8686 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8686 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8686 · Security Note
• https://bdu.fstec.ru/vul/2017-02240 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-8686 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-8686 · Vendor Advisory
• http://securityfocus.com/bid/100730 · Note
• http://securitytracker.com/id/1039337 · Note