Lucene search

K
cve[email protected]CVE-2017-8360
HistoryMay 12, 2017 - 7:29 a.m.

CVE-2017-8360

2017-05-1207:29:00
CWE-200
web.nvd.nist.gov
41
cve-2017-8360
conexant systems
mictray64
keystroke data
data leakage
hp elite
elitebook
probook
zbook
nvd

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.8%

Conexant Systems mictray64 task, as used on HP Elite, EliteBook, ProBook, and ZBook systems, leaks sensitive data (keystrokes) to any process. In mictray64.exe (mic tray icon) 1.0.0.46, a LowLevelKeyboardProc Windows hook is used to capture keystrokes. This data is leaked via unintended channels: debug messages accessible to any process that is running in the current user session, and filesystem access to C:\Users\Public\MicTray.log by any process.

Affected configurations

NVD
Node
conexantmictray64Range1.0.0.46
AND
hpelite_x2_1012_g1Match-
OR
hpelitebook_1030_g1Match-
OR
hpelitebook_725_g3Match-
OR
hpelitebook_745_g3Match-
OR
hpelitebook_755_g3Match-
OR
hpelitebook_820_g3Match-
OR
hpelitebook_828_g3Match-
OR
hpelitebook_840_g3Match-
OR
hpelitebook_848_g3Match-
OR
hpelitebook_850_g3Match-
OR
hpelitebook_folio_1040_g3Match-
OR
hpelitebook_folio_g1Match-
OR
hpprobook_430_g3Match-
OR
hpprobook_440_g3Match-
OR
hpprobook_446_g3Match-
OR
hpprobook_450_g3Match-
OR
hpprobook_455_g3Match-
OR
hpprobook_470_g3Match-
OR
hpprobook_640_g2Match-
OR
hpprobook_645_g2Match-
OR
hpprobook_650_g2Match-
OR
hpprobook_655_g2Match-
OR
hpzbook_15_g3Match-
OR
hpzbook_15u_g3Match-
OR
hpzbook_17_g3Match-
OR
hpzbook_studio_g3Match-
AND
microsoftwindows_10
OR
microsoftwindows_7

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.8%