CVE-2017-0074

EUVD-2017-0441

17.03.2017, 00:59

Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows 10, 1511, and 1607; and Windows Server 2016 allows guest OS users, running as virtual machines, to cause a denial of service via a crafted application, aka "Hyper-V Denial of Service Vulnerability." This vulnerability is different from those described in CVE-2017-0098, CVE-2017-0076, CVE-2017-0097, and CVE-2017-0099.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.4 MEDIUM	ADJACENT_NETWORK	HIGH	HIGH	CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 68%

Affected Products (NVD)

Vendor	Product	Version
microsoft	windows_10	*
microsoft	windows_7	*
microsoft	windows_8.1	*
microsoft	windows_server_2008	*
microsoft	windows_server_2012	*
microsoft	windows_server_2016	*
microsoft	windows_vista	*

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

(x64)	KB4012606
1511 (x64)	KB4013198
1607 (x64)	KB4013429

Windows 8.1

(x64)

KB4012216

Windows Server 2012

Server Core	KB4012217
Standard	KB4012217

Windows Server 2012 R2

Server Core	KB4012216
Standard	KB4012216

Windows Server 2016

Server Core	KB4013429
Standard	KB4013429

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

http://www.securityfocus.com/bid/96641

http://www.securitytracker.com/id/1037999

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0074

http://www.securityfocus.com/bid/96641

http://www.securitytracker.com/id/1037999

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0074