PT-2020-4309 · Microsoft · Windows Error Reporting Manager+1

Published 2020-10-13 · Updated 2023-12-31 · CVE-2020-16895

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Windows Error Reporting Manager (affected versions not specified)

Description: The issue is related to insufficient access restrictions in the Windows Error Reporting Manager, allowing an attacker to potentially elevate their privileges by running a specially crafted application. This could lead to an attacker gaining elevated status, potentially allowing them to delete targeted files. To exploit this, an attacker would first need to log on to the system and then run the specially crafted application.

Recommendations: To resolve the issue, apply the security update that corrects how Windows Error Reporting manager handles process crashes. As a temporary workaround, consider restricting access to the Windows Error Reporting manager until the security update is applied.

Fix

LPE

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-264

Related Identifiers

BDU:2020-04806

CVE-2020-16895

Affected Products

Windows

Windows Error Reporting Manager

References · 7

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-16895 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16895 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16895 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04806 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-16895 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16895 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2020101329 · Note