Kaspersky ID:
KLA10870
Detect Date:
09/13/2016
Updated:
02/02/2024

Description

Multiple serious vulnerabilities have been found in Windows. Malicious users can exploit these vulnerabilities to cause denial of service. execute arbitrary code, obtain sensitive information or gain privileges.

Below is a complete list of vulnerabilities

  1. An improper memory objects handling can be exploited by logged in attacker via a specially designed application to gain privileges or obtain sensitive information;
  2. An improper memory objects handling can be exploited remotely via a specially designed file or data to execute arbitrary code or cause denial of service;
  3. An improper permissions handling can be exploited locally via DLL hijack to gain privileges;
  4. An improper NTLM messages request validation can be exploited remotely via a specially designed content to obtain sensitive information;
  5. An improper sessions objects handling can be exploited locally via a specially designed application to gain privileges;
  6. Lack of information access restrictions can be exploited locally via a specially designed application to gain privileges;
  7. Lack of web-content loading restrictions can be exploited by attacker with physical access to execute arbitrary code;
  8. An improper requests handling can be exploited remotely via a specially designed SMB server to execute arbitrary code;
  9. An improper memory objects handling can be exploited remotely via a specially designed content to obtain sensitive information;
  10. An improper memory objects access can be exploited remotely via a specially designed content to execute arbitrary code.

Technical details

Vulnerability (4) can be mitigated via usage of enterprise perimeter firewall.

To exploit vulnerability (8) attacker must be able to establish an authenticated SMBv1 session to the SMBv1 Server. To mitigate this vulnerability you can disable SMBv1. For further instructions take a look at original advisory listed below.

Original advisories

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

CVE list

  • CVE-2016-3370
    high
  • CVE-2016-3374
    high
  • CVE-2016-3375
    critical
  • CVE-2016-3373
    high
  • CVE-2016-3368
    critical
  • CVE-2016-3369
    critical
  • CVE-2016-3371
    high
  • CVE-2016-3372
    high
  • CVE-2016-3306
    critical
  • CVE-2016-3344
    warning
  • CVE-2016-3345
    critical
  • CVE-2016-3346
    critical
  • CVE-2016-3348
    critical
  • CVE-2016-3349
    critical
  • CVE-2016-3352
    critical
  • CVE-2016-3302
    high
  • CVE-2016-3354
    warning
  • CVE-2016-3355
    critical
  • CVE-2016-3356
    critical
  • CVE-2016-3305
    critical

KB list

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com

Found an inaccuracy in the description of this vulnerability? Let us know!
Kaspersky Next
Let’s go Next: redefine your business’s cybersecurity
Learn more
New Kaspersky!
Your digital life deserves complete protection!
Learn more
Confirm changes?
Your message has been sent successfully.