CVE-2017-8461 Code injection in Microsoft Windows

What is CVE-2017-8461?

CVE-2017-8461 is a high-severity code injection vulnerability in Microsoft Windows Server 2003, published on 15 Jun 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Windows RPC with Routing and Remote Access enabled in Windows XP and Windows Server 2003 allows an attacker to execute code on a targeted RPC server which has Routing and Remote Access enabled via a specially crafted application, aka "Windows RPC Remote Code Execution Vulnerability."

Which versions are affected by CVE-2017-8461?

It affects 2 products.

Products include Microsoft Windows Server 2003, Microsoft Windows Xp.

How do I fix CVE-2017-8461?

No fix has been published for CVE-2017-8461 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2017-8461 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-8461 exists.

Public exploit code: 1 Metasploit module.

Other vulnerabilities in Microsoft Windows Server 2003

• CVE-2011-2005 Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Exploited High 7.8
• CVE-2013-3863 Memory corruption in n/a Critical 9.3
• CVE-2013-3181 Memory corruption in n/a Critical 9.3
• CVE-2013-0077 Code injection in n/a Critical 9.3
• CVE-2012-0009 Path traversal in n/a Critical 9.3

All Microsoft Windows Server 2003 vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3vvf-r92p-64xr.