CVE-2016-0007

Опубликовано: 13 янв. 2016

Источник: nvd

CVSS3: 7.8

CVSS2: 6.9

EPSS Низкий

Описание

The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles reparse points, which allows local users to gain privileges via a crafted application, aka "Windows Mount Point Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0006.

Ссылки

http://www.securityfocus.com/bid/79898
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1034645
Third Party Advisory
VDB Entry
https://code.google.com/p/google-security-research/issues/detail?id=589
Exploit
Mailing List
Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-008
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/39310/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/39311/
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/79898
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1034645
Third Party Advisory
VDB Entry
https://code.google.com/p/google-security-research/issues/detail?id=589
Exploit
Mailing List
Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-008
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/39310/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/39311/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

EPSS

Процентиль: 83%

0.01979

Низкий

7.8 High

CVSS3

6.9 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2016-0007

msrc

больше 9 лет назад

Описание отсутствует

GHSA-8mjx-vmhp-8fv4