SB2017061317 - Windows Kernel Information Disclosure Vulnerability
Published: June 13, 2017 Updated: March 25, 2018
Security Bulletin ID
SB2017061317
Severity
Low
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2017-8491)
The vulnerability allows a local authenticated attacker to obtain potentially sensitive information on the target system.The weakness exists due to improper initialization of objects in memory by the Windows kernel. A local attacker can run a specially crafted application and obtain information to perform further attacks.
Successful exploitation of the vulnerability results in information disclosure.
2) Information disclosure (CVE-ID: CVE-2017-8472)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory within win32k.sys system driver. A local user can obtain portions of potentially sensitive information from system memory.
Remediation
Install update from vendor's website.