Think you have a false positive on this rule?

Sid 1-42769

Message

OS-WINDOWS Microsoft Win32k kernel memory leak attempt

Summary

The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1 and Windows Server 2012 Gold allow a local authenticated attacker to execute a specially crafted application to obtain kernel information, aka "Win32k Information Disclosure Vulnerability."

Impact

CVSS base score 4.7 CVSS impact score 3.6 CVSS exploitability score 1.0 confidentialityImpact HIGH integrityImpact NONE availabilityImpact NONE

CVE-2017-0245:

CVSS base score 4.7

CVSS impact score 3.6

CVSS exploitability score 1.0

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Detailed information

CVE-2017-0245: The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1 and Windows Server 2012 Gold allow a local authenticated attacker to execute a specially crafted application to obtain kernel information, aka "Win32k Information Disclosure Vulnerability."

Affected systems

  • microsoft windows_7 *
  • microsoft windowsserver2008 *
  • microsoft windowsserver2008 r2
  • microsoft windowsserver2012 -

Ease of attack

CVE-2017-0245:

Access Vector

Access Complexity

Authentication

False positives

None known

False negatives

None known

Corrective action

Upgrade to the latest non-affected version of the software.

Apply the appropriate vendor supplied patches.

Contributors

  • Talos research team.
  • This document was generated from data supplied by the national vulnerability database, a product of the national institute of standards and technology.
  • For more information see nvd.

Additional References