CVE-2017-8535

Published May 26, 2017

Last updated 5 years ago

Overview

Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8536, CVE-2017-8537, CVE-2017-8539, and CVE-2017-8542.
Source: secure@microsoft.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 4.3
Impact score: 2.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:N/I:N/A:P

Weaknesses

nvd@nist.gov: CWE-119

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "21540673-614A-4D40-8BD7-3F07723803B0"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "232581CC-130A-4C62-A7E9-2EC9A9364D53"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "E01A4CCA-4C43-46E0-90E6-3E4DBFBACD64"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "AEE2E768-0F45-46E1-B6D7-087917109D98"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "C2B1C231-DE19-4B8F-A4AA-5B3A65276E46"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "E93068DB-549B-45AB-8E5C-00EB5D8B5CF8"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "C6CE5198-C498-4672-AF4C-77AB4BE06C5C"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*",
            "vulnerable": false,
            "matchCriteriaId": "B320A104-9037-487E-BC9A-62B4A6B49FD0"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*",
            "vulnerable": false,
            "matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "794244D1-F317-44C8-8338-3DA74E71D4B0"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:endpoint_protection:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AC297F51-9742-43A2-8783-53B7E4D5E435"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "27EF8DB7-D5A0-47A8-9F69-7D0259490D69"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8039FBA1-73D4-4FF2-B183-0DCC961CBFF7"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:forefront_endpoint_protection:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CC9503E8-6282-4F3A-A6DA-0FA8A9BD941B"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:forefront_endpoint_protection:2010:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E55E0DDF-4D05-4E5F-BC54-790A722E87A5"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:security_essentials:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "20FBA682-B703-4590-98E4-8897EED11DE0"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:system_center_endpoint_protection:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "194DE421-9536-4001-9A27-6C88805421EA"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:windows_intune_endpoint_protection:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D46404B0-83D5-4E54-8944-C8734645B80E"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Configurations

References