This is almost too sick to be true: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0295
Summary: windows server 2016 allows any user to pre-seed the template for new user profiles with malware in the autostart folder, all due to negligence@microsoft.com - Incredible. Think of terminal servers!
CVE - CVE-2017-0295Common Vulnerabilities and Exposures (CVE®) is a dictionary of common names (i.e., CVE Identifiers) for publicly known cyber security vulnerabilities. Assigned by CVE Numbering Authorities from around the world, use of CVE Identifiers ensures confidence among parties when used to discuss…
2
2 Comments
LVL 115

Comment

by:John
They did not put a date on this (that I could see) but implicated Windows 10 Creator Update as well.

Now there was a fair sized out-of-band Windows 10 Creator Update this afternoon (now build 15062.502 up from 483 yesterday).  

My guess is that Server 2016 got updated as well (but I do not know for sure).

Yet one more reason to keep current on updates.
0
LVL 76

Author Comment

by:McKnife
Hi John.

"Yet one more reason to keep current on updates" - I'd rather call it "one more reason to use applocker". Patches alone don't help. Also, the issue is not fully fixed by the patch. The startup folder is blocked for writing after the patch, but the rest of the profile is not. So still users can place malicious in the start menu template for new users. Microsoft is too lame to see.
This is true for server 2016 and any win10 system that is or has has ever been on v1607. See https://beingwinsysadmin.blogspot.de/2017/07/bug-windows-10-default-user-profile-is.html for the whole story.
0

Keep in touch with Experts Exchange

Tech news and trends delivered to your inbox every month