Lucene search

MicrosoftCVE-2017-0104

HistoryMar 17, 2017 - 12:59 a.m.

CVE-2017-0104

2017-03-1700:59:02

CWE-190

microsoft

web.nvd.nist.gov

cve-2017-0104

isns server

memory corruption

windows server 2008

windows server 2012

windows server 2016

integer overflow

remote attack

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.1

Confidence

High

EPSS

0.008

Percentile

81.9%

JSON

The iSNS Server service in Microsoft Windows Server 2008 SP2 and R2, Windows Server 2012 Gold and R2, and Windows Server 2016 allows remote attackers to issue malicious requests via an integer overflow, aka “iSNS Server Memory Corruption Vulnerability.”

Affected configurations

Nvd

Vulners

Node

microsoftwindows_server_2008Match-sp2

microsoftwindows_server_2008Matchr2

microsoftwindows_server_2012Match-

microsoftwindows_server_2012Matchr2

microsoftwindows_server_2016Match-

VendorProductVersionCPE
microsoftwindows_server_2008-cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
microsoftwindows_server_2008r2cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*
microsoftwindows_server_2012-cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoftwindows_server_2012r2cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
microsoftwindows_server_2016-cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows_server_2008	-	cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::
microsoft	windows_server_2008	r2	cpe:2.3:o:microsoft:windows_server_2008:r2:::::::*
microsoft	windows_server_2012	-	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
microsoft	windows_server_2012	r2	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
microsoft	windows_server_2016	-	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*

CNA Affected

[
  {
    "product": "iSNS Server",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "The iSNS Server service in Microsoft Windows Server 2008 SP2 and R2, Windows Server 2012 Gold and R2, and Windows Server 2016"
      }
    ]
  }
]