SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (Microsoft)  >   Windows Shell Vendors:   Microsoft
Windows Shell File Copy Destination Processing Flaw Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1039331
SecurityTracker URL:  http://securitytracker.com/id/1039331
CVE Reference:   CVE-2017-8699   (Links to External Site)
Date:  Sep 12 2017
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 7 SP1, 2008 R2 SP1, 2008 SP2, 8.1, RT 8.1, 2012, 2012 R2, 2016, 10, 10 Version 1511, 10 Version 1607, 10 Version 1703
Description:   A vulnerability was reported in Windows Shell. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted file that, when loaded by the target user, will exploit a flaw in processing file copy destinations to execute arbitrary code on the target user's system. The code will run with the privileges of the target user.

Pedro Gallegos of Microsoft Office Security Team reported this vulnerability.

Impact:   A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued a fix.

The Microsoft advisories are available at:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8699
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039266
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799

Vendor URL:  portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8699 (Links to External Site)
Cause:   Access control error

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC