Information disclosure in Microsoft Windows and Windows Server - CVE-2017-0057

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to an error in Windows dnsclient when processing DNS requests. A remote unauthenticated attacker can create a specially crafted web page, trick the victim into visiting it and force the client to connect to a malicious DNS server.

Successful exploitation of this vulnerability may allow an attacker to gain access to potentially sensitive information.

Affected software

How to mitigate CVE-2017-0057

Install updates from vendor's website.

External References

• https://technet.microsoft.com/en-us/library/security/MS17-012

Related Security Bulletins

• Information disclosure in Microsoft Windows dnsclient
• Windows DNS Query Information Disclosure Vulnerability