CVE-2017-0213
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.
Analysis
Windows COM Aggregate Marshaler allows local privilege escalation through improper handling of COM object creation, with public exploit code making this a common tool for red teams and adversaries.
Technical Context
The vulnerability in Windows COM's aggregate marshaler allows an attacker to exploit improper COM object initialization to execute code in a higher-privilege context. The publicly available exploit makes this accessible for post-exploitation privilege escalation.
Affected Products
['Microsoft Windows 7 SP1 through Windows 10 1703', 'Microsoft Windows Server 2008 R2 SP1 through Server 2016', 'Microsoft Windows RT 8.1']
Remediation
Apply Microsoft security update. Enforce least privilege for user accounts. Deploy application whitelisting to prevent execution of exploit tools.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today