CVE-2017-0057 — Sensitive Information Exposure in Corporation Windows Dnsclient

CWE-200 — Sensitive Information Exposure5 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
31.1%
top 3.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
Microsoft Corporation Windows DnsclientMicrosoft Windows 10Microsoft Windows Server 2012+11 more
Timeline
PublishedMar 17
Latest updateMay 17

Description

DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 fails to properly process DNS queries, which allows remote attackers to obtain sensitive information via (1) convincing a workstation user to visit an untrusted webpage or (2) tricking a server into sending a DNS query to a malicious DNS server, aka "Windows DNS Query Information Disclosure Vulnerability."

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages14 packages

▶CVEListV5microsoft_corporation/windows_dnsclientWindows DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016
▶NVDmicrosoft/windows_101511, 1607+1

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-gcfq-72w8-c7qj: DNS client in Microsoft Windows 8↗2022-05-17
▶

📋Vendor Advisories

1
Microsoft
Windows DNS Query Information Disclosure Vulnerability↗2017-03-14
▶

🕵️Threat Intelligence

2
Qualys
Massive Microsoft Patch Tuesday Security Update for March↗2017-03-14
▶
Qualys
Massive Microsoft Patch Tuesday Security Update for March | Qualys↗2017-03-14
▶