CVE-2016-3393 in microsoft windows 10 1507
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component RCE Vulnerability."
Affected software: microsoft windows 10 1507, microsoft windows 10 1511, microsoft windows 10 1607, microsoft windows 7, microsoft windows 8.1, microsoft windows rt 8.1, microsoft windows server 2008, microsoft windows server 2012, microsoft windows vista
Scores
- CVSS: 7.8 (high)
- EPSS: 68.47% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-05-25
- Published: 2016-10-14
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Install the MS16-120 Microsoft Graphics Component update (CVE-2016-3393)
Patch or upgrade. Installs Microsoft security update MS16-120 (KB3192884), which corrects how the Windows font library handles embedded fonts and removes the GDI remote code execution reachable through a crafted web site or document. Hosts on any later cumulative or monthly rollup update are also fixed.
Applies to: Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows Server 2012 and 2012 R2, Windows 10 1507, 1511 and 1607 without the October 2016 (MS16-120) update or a later rollup.
- Inventory Windows hosts that run Windows Vista SP2, Server 2008 SP2, Windows 7 SP1, Server 2008 R2 SP1, Windows 8.1, RT 8.1, Server 2012 / 2012 R2 or Windows 10 1507, 1511 or 1607.
- Check whether the October 2016 update or any later cumulative or monthly rollup is installed (Settings > Update history, or run 'wmic qfe list' / 'Get-HotFix' in PowerShell).
- Vista SP2 and Server 2008 SP2: install KB3191203.
- Windows 7 SP1 and Server 2008 R2 SP1: install the security-only update KB3192391 or the monthly rollup KB3185330 (or any later monthly rollup).
- Windows 8.1, RT 8.1 and Server 2012 R2: install the security-only update KB3192392 or the monthly rollup KB3185331 (or any later monthly rollup).
- Windows Server 2012: install the security-only update KB3192393 or the monthly rollup KB3185332 (or any later monthly rollup).
- Windows 10 1507: install cumulative update KB3192440; Windows 10 1511: KB3192441; Windows 10 1607: KB3194798 (or any later cumulative update).
- Restart the host to complete the update.
- Plan replacement or Extended Security Updates for operating systems that are out of support (Vista, Server 2008, Windows 7, Windows 8.1, early Windows 10 releases): they no longer get fixes for newer flaws.
- Rerun the vulnerability scan and confirm CVE-2016-3393 is no longer reported.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.