CVE-2017-0176 Memory corruption in Microsoft Windows Server 2003 SP1, SP2 Windows XP - SP3

What is CVE-2017-0176?

CVE-2017-0176 is a high-severity memory corruption vulnerability in Microsoft Windows Server 2003, published on 22 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a remote attacker to execute arbitrary code on the target computer, provided that the computer is joined in a Windows domain and has Remote Desktop Protocol connectivity (or Terminal Services) enabled.

Weakness: CWE-120

Which versions are affected by CVE-2017-0176?

It affects 2 products.

Products include Microsoft Windows Server 2003, Microsoft Windows Xp.

How do I fix CVE-2017-0176?

No fix has been published for CVE-2017-0176 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2017-0176 being exploited?

There is no known exploitation of CVE-2017-0176 in the wild and no public exploit code.

Other vulnerabilities in Microsoft Windows Server 2003

• CVE-2011-2005 Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Exploited High 7.8
• CVE-2013-3863 Memory corruption in n/a Critical 9.3
• CVE-2013-3181 Memory corruption in n/a Critical 9.3
• CVE-2013-0077 Code injection in n/a Critical 9.3
• CVE-2012-0009 Path traversal in n/a Critical 9.3

All Microsoft Windows Server 2003 vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2017-9073, GHSA-pw37-qhwf-p7xf.