CERT-In Vulnerability Note
CIVN-2016-0315
Multiple Vulnerabilities in Microsoft Windows
Original Issue Date:December 14, 2016
Severity Rating: MEDIUM
Software Affected
- Windows Vista SP2 and x64 Edition SP2
- Windows Server 2008 for 32-bit Systems SP2, x64-based Systems SP2 and Itanium-based Systems SP2
- Windows 7 for 32-bit Systems SP1 and x64-based Systems SP1
- Windows Server 2008 R2 for x64-based Systems SP1 and Itanium-based Systems SP1
- Windows 8.1 for 32-bit Systems and x64-based Systems
- Windows Server 2012
- Windows Server 2012 R2
- Windows RT 8.1
- Windows 10 for 32-bit Systems and x64-based Systems
- Windows 10 Version 1511 for 32-bit Systems and x64-based Systems
- Windows 10 Version 1607 for 32-bit Systems and x64-based Systems
- Windows Server 2016 for x64-based Systems
- Windows Server 2008 for 32-bit Systems SP2 (Server Core installation) and x64 Edition SP2(Server Core installation)
- Windows Server 2008 R2 for x64-based Systems SP1 (Server Core installation)
- Windows Server 2012(Server Core installation)
- Windows Server 2012 R2(Server Core installation)
- Windows Server 2016 for x64-based Systems (Server Core installation)
Overview
Multiple vulnerabilities have been reported in Microsoft Windows which could allow a local attacker to gain elevated privileges on the targeted system or obtain sensitive information.
Description
1. Windows Crypto Driver Information Disclosure Vulnerability
(
CVE-2016-7219
)
A vulnerability exists in Microsoft Windows due to improper handling of objects in memory by the Crypto driver running in kernel mode. A local, authentic attacker could exploit this vulnerability by logging on to the target system and executing a specially crafted application. Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information which could be leveraged to conduct further attacks.
2. Windows Installer Elevation of Privilege Vulnerability
(
CVE-2016-7292
)
A vulnerability exists in Windows Installer due to its failure to properly sanitize user-supplied input. A local authentic attacker could exploit this vulnerability by executing a specially crafted application leading to an insecure library loading behavior. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code with elevated privileges which could result in complete compromise of the targeted system.
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS16-149
Vendor Information
Microsoft
https://technet.microsoft.com/library/security/ms16-149
References
Microsoft
https://technet.microsoft.com/library/security/ms16-149
Cisco
https://tools.cisco.com/security/center/viewAlert.x?alertId=49970
https://tools.cisco.com/security/center/viewAlert.x?alertId=49971
Security Tracker
http://www.securitytracker.com/id/1037450
CVE Name
CVE-2016-7219
CVE-2016-7292
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|