Main Vulnerability Database SB20170314118

SB20170314118 - Hyper-V Remote Code Execution Vulnerability

Published: March 14, 2017

Security Bulletin ID SB20170314118

CSH Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2017-0075)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker with access to guest operating system to compromise the host system.

The vulnerability exists due to improper input validation in Windows Hyper-V. An attacker with access to guest operating system can execute arbitrary code on the host operating system.

Successful exploitation of this vulnerability may allow an attacker to escalate privileges.

Remediation

Install update from vendor's website.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0075