PT-2017-2948 · Microsoft+1 · Windows Search+9
Published
2017-10-10
·
Updated
2019-10-03
·
CVE-2017-11771
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows Server 2008 SP2 and R2 SP1
Microsoft Windows 7 SP1
Microsoft Windows 8.1
Microsoft Windows Server 2012 Gold and R2
Microsoft Windows RT 8.1
Microsoft Windows 10 versions 1507 through 1703
Microsoft Windows Server 2016
Description
The issue is related to a remote code execution vulnerability in the Microsoft Windows Search component. It occurs when the component fails to properly handle DNS responses or objects in memory. This can allow a remote attacker to execute arbitrary code, elevate privileges, or obtain confidential system information via an SMB connection. An unauthenticated, remote attacker could send specially crafted messages to the Windows Search service to exploit the vulnerability.
Recommendations
For Microsoft Windows Server 2008 SP2 and R2 SP1, update the system to apply the security patch.
For Microsoft Windows 7 SP1, apply the security update to fix the vulnerability.
For Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 versions 1507 through 1703, and Windows Server 2016, ensure the latest security patches are installed to resolve the issue.
As a temporary workaround, consider restricting access to the Windows Search service until a patch is applied.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Huawei Vrp
Windows
Windows 10
Windows 7
Windows 8.1
Windows Rt 8.1
Windows Search
Windows Server 2008
Windows Server 2012
Windows Server 2016