PT-2017-2956 · Microsoft · Windows Server 2016+11

Published 2017-09-12 · Updated 2019-05-10 · CVE-2017-8682

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 versions 1507 through 1703 Windows Server 2016 Microsoft Office Word Viewer Microsoft Office 2007 Service Pack 3 Microsoft Office 2010 Service Pack 2

Description The issue is related to the handling of embedded fonts, allowing an attacker to execute remote code. This can be achieved through specially crafted embedded fonts, potentially via a specially created website or document. An attacker who successfully exploits this issue could take control of the affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights.

Recommendations For Windows Server 2008 SP2 and R2 SP1, update the Windows font library to properly handle embedded fonts. For Windows 7 SP1, apply the security update to fix the improper handling of specially crafted embedded fonts. For Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 versions 1507 through 1703, ensure the Windows font library is updated to handle embedded fonts correctly. For Windows Server 2016, apply the relevant security patch to address the remote code execution vulnerability. For Microsoft Office Word Viewer, Microsoft Office 2007 Service Pack 3, and Microsoft Office 2010 Service Pack 2, update the software to a version that properly handles embedded fonts.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-02281

CVE-2017-8682

Affected Products

Office 2007

Office 2010

Office Word Viewer

Office

Windows

Windows 10

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2012

Windows Server 2016

References · 9

• 🔥 https://exploit-db.com/exploits/42744 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8682 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8682 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8682 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8682 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-8682 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02281 · Security Note
• http://securityfocus.com/bid/100772 · Note
• http://securitytracker.com/id/1039352 · Note