Vulnerability CVE-2013-3887 - CERT Civis.Net

Vulnerability Name:

CVE-2013-3887 (CCN-88367)

Assigned:

2013-11-12

Published:

2013-11-12

Updated:

2020-09-28

Summary:

The Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows local users to obtain sensitive information from kernel memory by leveraging improper copy operations, aka "Ancillary Function Driver Information Disclosure Vulnerability."

CVSS v3 Severity:

2.8 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.9 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:N/A:N)
1.3 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2013-3887

Source: CCN
Type: SA55558
Microsoft Windows Ancillary Function Driver Information Disclosure Weakness

Source: CCN
Type: Microsoft Security Bulletin MS13-093
Vulnerability in Windows Ancillary Function Driver Could Allow Information Disclosure (2875783)

Source: CCN
Type: Microsoft Security Bulletin MS14-040
Vulnerability in Ancillary Function Driver (AFD) Could Allow Elevation of Privilege (2975684)

Source: CCN
Type: Microsoft Security Bulletin MS15-119
Security Update in Winsock to Address Elevation of Privilege (3104521)

Source: CCN
Type: BID-63545
Microsoft Windows Ancillary Function Driver CVE-2013-3887 Local Information Disclosure Vulnerability

Source: CERT
Type: US Government Resource
TA13-317A

Source: MS
Type: UNKNOWN
MS13-093

Source: XF
Type: UNKNOWN
ms-afd-cve20133887-info-disc(88367)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:18805

Vulnerable Configuration:

Configuration 1:

cpe:/o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_8:-:*:*:*:pro_n:*:x64:*

OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

Configuration CCN 1:

cpe:/o:microsoft:windows:server_2003:sp2:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows:server_2003:sp2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp::sp2:x64:*:professional:*:*:*

OR cpe:/o:microsoft:windows_vista:-:sp2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:itanium:*

OR cpe:/o:microsoft:windows_7:-:sp1:*:*:ultimate_n:*:x64:*

OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*

OR cpe:/o:microsoft:windows_8:-:-:-:*:-:-:x64:*

OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:18805	V	Ancillary Function Driver Information Disclosure Vulnerability (CVE-2013-3887) - MS13-093	2013-12-30