Kaspersky Threats

Описание

Multiple serious vulnerabilities have been found in Windows. Malicious users can exploit these vulnerabilities to cause denial of service. execute arbitrary code, obtain sensitive information or gain privileges.

Below is a complete list of vulnerabilities

An improper memory objects handling can be exploited by logged in attacker via a specially designed application to gain privileges or obtain sensitive information;
An improper memory objects handling can be exploited remotely via a specially designed file or data to execute arbitrary code or cause denial of service;
An improper permissions handling can be exploited locally via DLL hijack to gain privileges;
An improper NTLM messages request validation can be exploited remotely via a specially designed content to obtain sensitive information;
An improper sessions objects handling can be exploited locally via a specially designed application to gain privileges;
Lack of information access restrictions can be exploited locally via a specially designed application to gain privileges;
Lack of web-content loading restrictions can be exploited by attacker with physical access to execute arbitrary code;
An improper requests handling can be exploited remotely via a specially designed SMB server to execute arbitrary code;
An improper memory objects handling can be exploited remotely via a specially designed content to obtain sensitive information;
An improper memory objects access can be exploited remotely via a specially designed content to execute arbitrary code.

Technical details

Vulnerability (4) can be mitigated via usage of enterprise perimeter firewall.

To exploit vulnerability (8) attacker must be able to establish an authenticated SMBv1 session to the SMBv1 Server. To mitigate this vulnerability you can disable SMBv1. For further instructions take a look at original advisory listed below.

Первичный источник обнаружения

Эксплуатация

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Связанные продукты

Список CVE

CVE-2016-3370
high
CVE-2016-3374
high
CVE-2016-3375
critical
CVE-2016-3373
high
CVE-2016-3368
critical
CVE-2016-3369
critical
CVE-2016-3371
high
CVE-2016-3372
high
CVE-2016-3306
critical
CVE-2016-3344
warning
CVE-2016-3345
critical
CVE-2016-3346
critical
CVE-2016-3348
critical
CVE-2016-3349
critical
CVE-2016-3352
critical
CVE-2016-3302
high
CVE-2016-3354
warning
CVE-2016-3355
critical
CVE-2016-3356
critical
CVE-2016-3305
critical

Список KB

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com

Нашли неточность в описании этой уязвимости? Дайте нам знать!