CVE-2016-3299
CVSS V2 Medium 4.3
CVSS V3 Medium 5.3
Description
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow remote attackers to hijack network traffic or bypass intended Enhanced Protected Mode (EPM) or application container protection mechanisms, and consequently render untrusted content in a browser, by leveraging how NetBIOS validates responses, aka "NetBIOS Spoofing Vulnerability."
Overview
- CVE ID
- CVE-2016-3299
- Assigner
- secure@microsoft.com
- Vulnerability Status
- Modified
- Published Version
- 2016-08-09T21:59:09
- Last Modified Date
- 2018-10-12T22:12:24
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:N/C:N/I:P/A:N
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- NONE
- Integrity Impact
- PARTIAL
- Availability Impact
- NONE
- Base Score
- 4.3
- Severity
- MEDIUM
- Exploitability Score
- 8.6
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
- Attack Vector
- NETWORK
- Attack Compatibility
- HIGH
- Privileges Required
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality Impact
- NONE
- Availability Impact
- NONE
- Base Score
- 5.3
- Base Severity
- MEDIUM
- Exploitability Score
- 1.6
- Impact Score
- 3.6
References
| Reference URL | Reference Tags |
|---|---|
| http://www.securityfocus.com/bid/92387 | |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-077 |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2016-3299 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3299 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 18:22:38 | Added to TrackCVE | |||
| 2022-12-02 10:52:11 | 2016-08-09T21:59Z | 2016-08-09T21:59:09 | CVE Published Date | updated |
| 2022-12-02 10:52:11 | 2018-10-12T22:12:24 | CVE Modified Date | updated | |
| 2022-12-02 10:52:11 | Modified | Vulnerability Status | updated |