CVE-2017-0045: CSRF
An information disclosure vulnerability exists in Windows when Windows DVD Maker fails to properly parse a specially crafted .msdvd file. An attacker who successfully exploited the vulnerability could obtain information to further compromise a target system. To exploit the vulnerability, an attacker would have to either log on locally to an affected system or convince a locally authenticated user to execute a specially crafted application. The security update addresses the vulnerability by correcting how Windows DVD Maker parses files.
Other sources
Windows DVD Maker in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Vista SP2 does not properly parse crafted .msdvd files, which allows attackers to obtain information to compromise a target system, aka "Windows DVD Maker Cross-Site Request Forgery Vulnerability."
— MITRE
Windows DVD Maker XML External Entity Information Disclosure Vulnerability
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-0045?
CVE-2017-0045 is considered a medium severity vulnerability as it allows attackers to potentially compromise target systems.
How do I fix CVE-2017-0045?
To fix CVE-2017-0045, ensure that you are using the latest updates and patches provided by Microsoft for affected versions of Windows.
What systems are affected by CVE-2017-0045?
CVE-2017-0045 affects Windows 7 SP1, Windows Server 2008 SP2, Windows Server 2008 R2 SP1, and Windows Vista SP2.
What type of vulnerability is CVE-2017-0045?
CVE-2017-0045 is a cross-site request forgery vulnerability associated with Windows DVD Maker.
Can CVE-2017-0045 lead to additional attacks?
Yes, exploiting CVE-2017-0045 may provide attackers with sensitive information that could lead to further compromise of the system.