NVD Vulnerability Detail

CVE-2017-0176

Summary	A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a remote attacker to execute arbitrary code on the target computer, provided that the computer is joined in a Windows domain and has Remote Desktop Protocol connectivity (or Terminal Services) enabled.
Publication Date	June 22, 2017, 11:29 p.m.
Registration Date	Jan. 26, 2021, 1:10 p.m.
Last Update	Nov. 21, 2024, 12:02 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:microsoft:windows_xp::sp2::::::*
cpe:2.3:o:microsoft:windows_server_2003::::::::
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_xp::sp1::::::*
cpe:2.3:o:microsoft:windows_xp::::::::

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/98550	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/98550	Third Party Advisory VDB Entry
3	http://www.securityfocus.com/bid/98752	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/98752	Third Party Advisory VDB Entry
5	https://blog.0patch.com/2017/06/a-quick-analysis-of-microsofts.html
6	https://blog.0patch.com/2017/06/a-quick-analysis-of-microsofts.html
7	https://blog.fortinet.com/2017/05/11/deep-analysis-of-esteemaudit	Exploit Third Party Advisory
8	https://blog.fortinet.com/2017/05/11/deep-analysis-of-esteemaudit	Exploit Third Party Advisory
9	https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/	Patch Vendor Advisory
10	https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/	Patch Vendor Advisory
11	https://support.microsoft.com/en-us/help/4022747/security-update-for-windows-xp-and-windows-server-2003	Patch Vendor Advisory
12	https://support.microsoft.com/en-us/help/4022747/security-update-for-windows-xp-and-windows-server-2003	Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-120	古典的バッファオーバーフロー	https://cwe.mitre.org/data/definitions/120.html

JVN Vulnerability Information

Microsoft Windows XP および Server 2003 の gpkcsp.dll の Smart Card 認証コードにおけるバッファオーバーフローの脆弱性

Title	Microsoft Windows XP および Server 2003 の gpkcsp.dll の Smart Card 認証コードにおけるバッファオーバーフローの脆弱性
Summary	Microsoft Windows XP および Server 2003 の gpkcsp.dll の Smart Card 認証コードには、バッファオーバーフローの脆弱性が存在します。
Possible impacts	リモートの攻撃者により、コンピュータが Windows ドメインに参加し、リモートデスクトッププロトコル接続 (またはターミナルサービス) が有効になっている場合、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 13, 2017, midnight
Registration Date	July 6, 2017, 10:48 a.m.
Last Update	July 6, 2017, 10:48 a.m.

Affected System

マイクロソフト

Microsoft Windows Server 2003

Microsoft Windows XP sp3

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-0176	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0176
Microsoft Support
2	CVE-2017-0176 \| Remote desktop protocol remote code execution vulnerability	https://support.microsoft.com/en-us/help/4022747/security-update-for-windows-xp-and-windows-server-2003
Microsoft サポート
3	CVE-2017-0176 \| リモートデスクトッププロトコル接続のリモートでコードが実行される脆弱性	https://support.microsoft.com/ja-jp/help/4022747/security-update-for-windows-xp-and-windows-server-2003
National Vulnerability Database (NVD)
4	CVE-2017-0176	https://nvd.nist.gov/vuln/detail/CVE-2017-0176

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-284	https://cwe.mitre.org/data/definitions/284.html

その他

No	Name	URL
IPA 重要なセキュリティ情報
1	Microsoft 製品の脆弱性対策について(2017年6月)	https://www.ipa.go.jp/security/ciadr/vul/20170614-ms.html
JPCERT 注意喚起
2	JPCERT-AT-2017-0022	http://www.jpcert.or.jp/at/2017/at170022.html

Change Log

No	Changed Details	Date of change
0	[2017年07月06日] 掲載	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:microsoft:windows_xp::sp2::::::*
cpe:2.3:o:microsoft:windows_server_2003::::::::
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_xp::sp1::::::*
cpe:2.3:o:microsoft:windows_xp::::::::