CVE-2017-0250

Меры по смягчению последствий

The following mitigating factors may be helpful in your situation: An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Обходное решение

Restrict the Microsoft Jet Database Engine from running for any application To implement the workaround, enter the following command at a command prompt:

echo y| cacls "%SystemRoot%\system32\msjet40.dll" /E /P everyone:N

Impact of workaround. Any application requiring the use of the Microsoft Jet Database Engine to make data access calls will not function.

How to undo the workaround. Enter the following command at a command prompt

echo y| cacls "%SystemRoot%\system32\msjet40.dll" /E /R everyone

Use group policy to restrict the Microsoft Jet Database Engine from running for any application To implement the workaround, perform the following steps:

1. Create the following script, named JetCacls.cmd for illustration:

2. Copy JetCacls.cmd to the Netlogon shared folder, or another shared folder on the domain controller from which JetCacls.cmd would run.
3. Set up JetCacls.cmd. In the Active Directory Users and Computers MMC snap-in, right-click the domain name, and then click Properties.
4. Click the** Group Policy** tab.
5. Click New to create a new Group Policy object (GPO), and enter JetCacls for the name of the policy.
6. Click the new policy, and then click Edit.
7. Expand Windows Settings for Computer Configuration, and then click Scripts.
8. Double-click Logon, and then click Add. The Add a Script dialog box appears.
9. Type \servername\sharename\JetCacls.cmd in the Script Name box.
10. Click OK, and then click Apply.
11. Then restart the client computers that are members of this domain.

Impact of workaround. Any application that requires the use of the Microsoft Jet Database Engine to make data access calls will not function. This restriction only applies to applications that are running on client computers in the domain.