CVE-2017-0004HighCVSS 6.5

Local Security Authority Subsystem Service Denial of Service Vulnerability

Published
January 10, 2017
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2017-0004 →

📋 Description

This security update corrects a denial of service in the Local Security Authority Subsystem Service (LSASS) caused when an unauthenticated attacker sends a specially crafted authentication request. A remote attacker who successfully exploited this vulnerability could cause a denial of service on the target system's LSASS service, which triggers an automatic reboot of the system. The security update addresses the vulnerability by changing the way that LSASS handles specially crafted authentication requests.

🎯 Affected products12

  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for Itanium-Based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Vista Service Pack 2
  • Windows Vista x64 Edition Service Pack 2

✅ Remediation

KB3212646 (Monthly Rollup) KB3212642 (Security Only) KB3216775 (Security Update)

🔗 References (4)