CVE-2016-3393
Published: 14 October 2016
Summary
CVE-2016-3393 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 1.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
The vulnerability is a remote code execution flaw in the Graphics Device Interface (GDI/GDI+) component of Microsoft Windows. It affects Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607. The issue is tracked as the "Windows Graphics Component RCE Vulnerability" and carries a CVSS 3.1 base score of 7.8.
An attacker can exploit the flaw by serving a crafted web site to a victim. Successful exploitation grants the ability to execute arbitrary code on the target system with the privileges of the logged-on user, provided the user visits the malicious site.
Microsoft addressed the issue in security bulletin MS16-120, which is referenced in public vulnerability databases along with related tracking entries at SecurityFocus and SecurityTracker. Organizations should apply the vendor-supplied updates to eliminate the exposure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2016-4419
Vulnerability details
Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607…
more
allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component RCE Vulnerability."
- CWE(s)
- KEV Date Added
- 25 May 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor-supplied security update (MS16-120) that eliminates the GDI+ RCE flaw before exploitation can occur.
Malicious-code protection mechanisms can block or alert on the crafted web content used to trigger the GDI+ vulnerability.
Least-privilege restrictions limit the impact of arbitrary code execution to the privileges of the logged-on user who visits the malicious site.