Information disclosure in Windows DVD Maker
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2017-0045 |
| CWE-ID | CWE-611 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software Subscribe |
Windows Operating systems & Components / Operating system |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 1 vulnerabilities.
2017-03-16: Vulnerability description was updated.
1) XML injection
EUVDB-ID: #VU5956
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L/E:P/RL:O/RC:C]
CVE-ID: CVE-2017-0045
CWE-ID:
CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
Exploit availability: Yes
DescriptionThe disclosed vulnerability allows a remote attacker to gain access to potentially sensitive data.
The vulnerability exists due to a flaw in Windows DVD Maker when parsing a malicious .msdvd file. A remote attacker can create a specially crafted .msdvd file, trick the victim into opening it and read arbitrary file on the victim's computer.
Successful exploitation of this vulnerability may allow an attacker to read arbitrary file on victim's computer.
Install update from vendor's website.
Windows: 7 - Vista
External linkshttp://technet.microsoft.com/en-us/library/security/MS17-020
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-DVD-MAKER-XML-EXTERNAL-ENTITY-FILE-DISCLOSURE.t...
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
