KLA10924 Privilege escalation and information disclosure vulnerabilities in Microsoft Windows

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to obtain sensitive information or gain privileges.

Below is a complete list of vulnerabilities:

1. An improper handling of objects in memory while running a Windows Crypto driver in kernel mode can be exploited locally via a specially designed application to obtain sensitive information;
2. Improper sanitizing of input (which leads to an insecure library loading behavior) in the Windows Installer can be exploited locally via a specially designed application to gain privileges;
3. An improper handling of objects in memory in the Windows Common Log File System (CLFS) can be exploited locally via a specially designed application to obtain sensitive information from process memory.

Original advisories

MS16-149

MS16-153

CVE-2016-7271

CVE-2016-7273

CVE-2016-7272

CVE-2016-7257

CVE-2016-7281

CVE-2016-7279

CVE-2016-7278

CVE-2016-7283

CVE-2016-7282

CVE-2016-7292

CVE-2016-7274

CVE-2016-7295

CVE-2016-7219

CVE-2016-7258

CVE-2016-7259

CVE-2016-7260

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Windows-Vista-4

Microsoft-Windows-Server-2012

Microsoft-Windows-8

Microsoft-Windows-7

Microsoft-Windows-Server-2008

Microsoft-Windows-10

CVE list

CVE-2016-7271 warning

CVE-2016-7273 critical

CVE-2016-7272 critical

CVE-2016-7257 warning

CVE-2016-7281 warning

CVE-2016-7279 critical

CVE-2016-7278 warning

CVE-2016-7283 critical

CVE-2016-7282 warning

CVE-2016-7292 high

CVE-2016-7274 critical

CVE-2016-7295 warning

CVE-2016-7219 warning

CVE-2016-7258 warning

CVE-2016-7259 high

CVE-2016-7260 high

KB list

3208481

3205386

3205383

3205401

3205400

3205408

3205409

3207752

3205394

3206632

3196726

3203838

3196348

3204724

3204808

3205638

3204723

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Microsoft Windows Vista Service Pack 2 Microsoft Windows 7Microsoft Windows 7 Service Pack 1Microsoft Windows 8.1Microsoft Windows 10Microsoft Windows Server 2008Microsoft Windows Server 2008 Service Pack 2Microsoft Windows Server 2008 R2 Service Pack 1 Microsoft Windows Server 2012Microsoft Windows Server 2012 R2Microsoft Windows Server 2016