Integer overflow in Windows Server - CVE-2017-0104
Published: March 14, 2017 / Updated: March 14, 2017
Vulnerability identifier: #VU6028
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-0104
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in Windows iSNS Server service when processing input from the client. A remote unauthenticated attacker can send a specially crafted request to vulnerable iSNS Serverand execute arbitrary code with SYSTEM privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Windows Server
How to mitigate CVE-2017-0104
Install updates from vendor's website.