CVE-2016-3209
published 2016-10-14CVE-2016-3209: Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012…
PriorityP351medium5.5CVSS 3.0
AVLACLPRNUIRSUCHINAN
EXPLOIT
EPSS
53.65%
99.0th percentile
Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; Live Meeting 2007 Console; .NET Framework 3.0 SP2, 3.5, 3.5.1, 4.5.2, and 4.6; and Silverlight 5 allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "True Type Font Parsing Information Disclosure Vulnerability."
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | live_meeting | — | — |
| microsoft | lync | — | — |
| microsoft | lync | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | silverlight | — | — |
| microsoft | skype_for_business | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2012 | — | — |
| msrc | microsoft_live_meeting_2007_console | — | — |
| msrc | microsoft_lync_2010 | — | — |
| msrc | microsoft_lync_2010_attendee | — | — |
| msrc | microsoft_lync_2013_service_pack_1 | — | — |
| msrc | microsoft_lync_basic_2013_service_pack_1 | — | — |
| msrc | microsoft_net_framework_3.0_service_pack_2 | — | — |
| msrc | microsoft_net_framework_3.5 | — | — |
| msrc | microsoft_net_framework_3.5.1 | — | — |
| msrc | microsoft_net_framework_4.5.2 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: hovering over or opening a malicious TTF font file in Windows Font Viewer is sufficient to trigger the out-of-bounds read in win32k!itrp_GetCVTEntryFast via the RCVT TrueType instruction handler. ↗
- →The vulnerability is triggered by a corrupted TTF font file causing win32k!itrp_GetCVTEntryFast to access an out-of-bounds CVT table index (up to 255) via the RCVT TrueType instruction, enabling kernel memory disclosure / KASLR bypass. ↗
- →Crash signature to look for in kernel crash dumps: BUGCHECK_STR 0x50 (PAGE_FAULT_IN_NONPAGED_AREA) with FAULTING_MODULE win32k and faulting function win32k!itrp_GetCVTEntryFast. ↗
- →Enable Special Pools for win32k.sys to reliably reproduce/detect crashes caused by this vulnerability during testing. ↗
- →The vulnerability can be used to disclose adjacent kernel pool memory contents to user-mode, potentially leaking sensitive kernel memory or facilitating a KASLR bypass, and may be chained with a remote code execution vulnerability. ↗
- ·The out-of-bounds read only affects win32k!itrp_GetCVTEntryFast (RCVT handler); the corresponding write instruction handler (WCVT) does not appear to be affected by the same problem. ↗
- ·The Office 2010 update for this CVE is not applicable on Windows Vista and later because the vulnerable code is not present in that configuration. ↗
- ·Customers running affected editions of Microsoft Lync 2013 (Skype for Business) must first install prerequisite updates 2965218 and 3039779 before applying the security update for this CVE. ↗
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_msrc5.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
GDI+ Information Disclosure Vulnerability
vendor_msrc·2016-10-11·CVSS 5.5
CVE-2016-3209 [MEDIUM] GDI+ Information Disclosure Vulnerability
GDI+ Information Disclosure Vulnerability
Description: An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system. An attacker who successfully exploited this vulnerability could use the retrieved information to circumvent Address Space Layout Randomization (ASLR) in Windows, which helps guard against a broad class of vulnerabilities. By itself, the information disclosure does not allow arbitrary code execution; however, it could allow arbitrary code to be run if the attacker uses it in combination with another vulnerability, such as a remote code execution vulnerability, that is capable of leveraging the ASLR circumvention.
To exploit this vulnera
GHSA
GHSA-xgx5-xw2j-vm46: Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8
ghsa_unreviewed·2022-05-14
CVE-2016-3209 [MEDIUM] CWE-200 GHSA-xgx5-xw2j-vm46: Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8
Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; Live Meeting 2007 Console; .NET Framework 3.0 SP2, 3.5, 3.5.1, 4.5.2, and 4.6; and Silverlight 5 allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "True Type Font Parsing Information Disclosure Vulnerability."
No detection rules found.
Talos
Microsoft Patch Tuesday - October 2016
blogs_talos·2016-10-11·CVSS 5.5
[MEDIUM] Microsoft Patch Tuesday - October 2016
Patch Tuesday has once again arrived! Microsoft's monthly release of security bulletins to address vulnerabilities provides fixes for 37 newly disclosed security flaws. Today's release sees a total of 10 bulletins with five of the bulletins rated critical and address vulnerabilities in Edge, Graphics Component, Internet Explorer, Video Control, and Adobe Flash Player. Four bulletins are rated important and address flaws in Office, Windows Diagnostic Hub, Windows Kernel-Mode Drivers, and Windows Registry. One bulletin is rated moderate and addresses a flaw in Microsoft Internet Messaging API.
## Bulletins Rated Critical The following bulletins are rated critical: MS16-118, MS16-119, MS16-120, MS16-122, MS16-127
MS16-118 and MS16-119 are this month's bulletins for Internet Explorer and Edg
Talos
Microsoft Patch Tuesday - October 2016
blogs_talos·2016-10-11·CVSS 5.5
[MEDIUM] Microsoft Patch Tuesday - October 2016
## Microsoft Patch Tuesday - October 2016
Patch Tuesday has once again arrived! Microsoft's monthly release of security bulletins to address vulnerabilities provides fixes for 37 newly disclosed security flaws. Today's release sees a total of 10 bulletins with five of the bulletins rated critical and address vulnerabilities in Edge, Graphics Component, Internet Explorer, Video Control, and Adobe Flash Player. Four bulletins are rated important and address flaws in Office, Windows Diagnostic Hub, Windows Kernel-Mode Drivers, and Windows Registry. One bulletin is rated moderate and addresses a flaw in Microsoft Internet Messaging API.
## Bulletins Rated Critical The following bulletins are rated critical: MS16-118, MS16-119, MS16-120, MS16-122, MS16-127
MS16-118 and MS16-119 are this mont
http://www.securityfocus.com/bid/93385http://www.securitytracker.com/id/1036988https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-120http://www.securityfocus.com/bid/93385http://www.securitytracker.com/id/1036988https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-120
2016-10-14
Published