Vulnerabilities > CVE-2017-8635 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Microsoft Edge and Internet Explorer

047910
CVSS 7.6 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
high complexity
microsoft
CWE-119
nessus
exploit available

Summary

Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to the way that JavaScript engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

descriptionMicrosoft Edge Chakra - Incorrect Usage of 'TryUndeleteProperty'. CVE-2017-8635. Dos exploit for Windows platform
fileexploits/windows/dos/42471.html
idEDB-ID:42471
last seen2017-08-17
modified2017-08-17
platformwindows
port
published2017-08-17
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/42471/
titleMicrosoft Edge Chakra - Incorrect Usage of 'TryUndeleteProperty'
typedos

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_AUG_INTERNET_EXPLORER.NASL
    descriptionThe Internet Explorer installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-0228) - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8651) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8635, CVE-2017-8641) - A remote code execution vulnerability exists in the way Microsoft browsers handle objects in memory while rendering content. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8669) - A remote code execution vulnerability exists when Microsoft browsers improperly access objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8653) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8636)
    last seen2020-06-01
    modified2020-06-02
    plugin id104890
    published2017-11-30
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/104890
    titleSecurity Updates for Internet Explorer (August 2017)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(104890);
      script_version("1.6");
      script_cvs_date("Date: 2018/08/03 11:35:09");
    
      script_cve_id(
        "CVE-2017-0228",
        "CVE-2017-8635",
        "CVE-2017-8636",
        "CVE-2017-8641",
        "CVE-2017-8651",
        "CVE-2017-8653",
        "CVE-2017-8669"
      );
      script_bugtraq_id(
        98164,
        100055,
        100056,
        100057,
        100058,
        100059,
        100068
      );
      script_xref(name:"MSKB", value:"4034733");
      script_xref(name:"MSKB", value:"4034681");
      script_xref(name:"MSKB", value:"4034664");
      script_xref(name:"MSKB", value:"4034665");
      script_xref(name:"MSFT", value:"MS17-4034733");
      script_xref(name:"MSFT", value:"MS17-4034681");
      script_xref(name:"MSFT", value:"MS17-4034664");
      script_xref(name:"MSFT", value:"MS17-4034665");
    
      script_name(english:"Security Updates for Internet Explorer (August 2017)");
      script_summary(english:"Checks for Microsoft security updates.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The Internet Explorer installation on the remote host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The Internet Explorer installation on the remote host is
    missing security updates. It is, therefore, affected by
    multiple vulnerabilities :
    
      - A remote code execution vulnerability exists in the way
        JavaScript engines render when handling objects in
        memory in Microsoft browsers. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2017-0228)
    
      - A remote code execution vulnerability exists when
        Internet Explorer improperly accesses objects in memory.
        The vulnerability could corrupt memory in such a way
        that an attacker could execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2017-8651)
    
      - A remote code execution vulnerability exists in the way
        JavaScript engines render when handling objects in
        memory in Microsoft browsers. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2017-8635, CVE-2017-8641)
    
      - A remote code execution vulnerability exists in the way
        Microsoft browsers handle objects in memory while
        rendering content. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2017-8669)
    
      - A remote code execution vulnerability exists when
        Microsoft browsers improperly access objects in memory.
        The vulnerability could corrupt memory in such a way
        that enables an attacker to execute arbitrary code in
        the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2017-8653)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browser JavaScript engines render content
        when handling objects in memory. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. In a web-based attack scenario, an attacker could
        host a specially crafted website that is designed to
        exploit the vulnerability through Microsoft browsers and
        then convince a user to view the website. An attacker
        could also embed an ActiveX control marked "safe
        for initialization" in an application or Microsoft
        Office document that hosts the related rendering engine.
        The attacker could also take advantage of compromised
        websites, and websites that accept or host user-provided
        content or advertisements. These websites could contain
        specially crafted content that could exploit the
        vulnerability. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2017-8636)");
      # https://support.microsoft.com/en-us/help/4034733/cumulative-security-update-for-internet-explorer
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8d0edc6a");
      # https://support.microsoft.com/en-us/help/4034681/windows-8-1-windows-server-2012-r2-update-kb4034681
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1d4d1833");
      # https://support.microsoft.com/en-us/help/4034664/windows-7-sp1-windows-server-2008-r2-sp1-update-kb4034664
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bf044da8");
      # https://support.microsoft.com/en-us/help/4034665/windows-server-2012-update-kb4034665
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5a9af664");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released security updates for the affected versions of Internet Explorer.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/08/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/08/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/11/30");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:ie"); 
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
      script_copyright(english:"This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.");
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = 'MS17-08';
    kbs = make_list(
      '4034733',
      '4034681',
      '4034664',
      '4034665'
    );
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    os = get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(vista:'2', win7:'1', win8:'0',  win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Windows 8" >< productname && "8.1" >!< productname)
     audit(AUDIT_OS_SP_NOT_VULN);
    if ("Vista" >< productname) audit(AUDIT_OS_SP_NOT_VULN);
    
    if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      # Windows 8.1 / Windows Server 2012 R2
      # Internet Explorer 11
      hotfix_is_vulnerable(os:"6.3", sp:0, file:"mshtml.dll", version:"11.0.9600.18763", min_version:"11.0.9600.16000", dir:"\system32", bulletin:bulletin, kb:"4034733") ||
    
      # Windows Server 2012
      # Internet Explorer 10
      hotfix_is_vulnerable(os:"6.2", sp:0, file:"mshtml.dll", version:"10.0.9200.22227", min_version:"10.0.9200.16000", dir:"\system32", bulletin:bulletin, kb:"4034733") ||
    
      # Windows 7 / Server 2008 R2
      # Internet Explorer 11
      hotfix_is_vulnerable(os:"6.1", sp:1, file:"mshtml.dll", version:"11.0.9600.18763", min_version:"11.0.9600.16000", dir:"\system32", bulletin:bulletin, kb:"4034733") ||
    
      # Vista / Windows Server 2008
      # Internet Explorer 9
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"mshtml.dll", version:"9.0.8112.21040", min_version:"9.0.8112.20000", dir:"\system32", bulletin:bulletin, kb:"4034733") ||
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"mshtml.dll", version:"9.0.8112.16929", min_version:"9.0.8112.16000", dir:"\system32", bulletin:bulletin, kb:"4034733")
    )
    {
      report =  '\nNote: The fix for this issue is available in either of the following updates:\n';
      report += '  - KB4034733 : Cumulative Security Update for Internet Explorer\n';
      if(os == "6.3")
      {
        report += '  - KB4034681 : Windows 8.1 / Server 2012 R2 Monthly Rollup\n';
        hotfix_add_report(bulletin:'MS17-08', kb:'4034681', report);
      }
      else if(os == "6.2")
      {
        report += '  - KB4034665 : Windows Server 2012 Monthly Rollup\n';
        hotfix_add_report(bulletin:'MS17-08', kb:'4034665', report);
      }
      else if(os == "6.1")
      {
        report += '  - KB4034664 : Windows 7 / Server 2008 R2 Monthly Rollup\n';
        hotfix_add_report(bulletin:'MS17-08', kb:'4034664', report);
      }
      set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_AUG_4034681.NASL
    descriptionThe remote Windows host is missing security update 4034672 or cumulative update 4034681. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists when Microsoft Windows improperly handles NetBIOS packets. An attacker who successfully exploited this vulnerability could cause a target computer to become completely unresponsive. A remote unauthenticated attacker could exploit this vulnerability by sending a series of TCP packets to a target system, resulting in a permanent denial of service condition. The update addresses the vulnerability by correcting how the Windows network stack handles NetBIOS traffic. (CVE-2017-0174) - A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-0250) - A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-0293) - A remote code execution vulnerability exists in Windows Input Method Editor (IME) when IME improperly handles parameters in a method of a DCOM class. The DCOM server is a Windows component installed regardless of which languages/IMEs are enabled. An attacker can instantiate the DCOM class and exploit the system even if IME is not enabled. (CVE-2017-8591) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-8593) - A remote code execution vulnerability exists when Windows Search handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.To exploit the vulnerability, the attacker could send specially crafted messages to the Windows Search service. An attacker with access to a target computer could exploit this vulnerability to elevate privileges and take control of the computer. Additionally, in an enterprise scenario, a remote unauthenticated attacker could remotely trigger the vulnerability through an SMB connection and then take control of a target computer.The security update addresses the vulnerability by correcting how Windows Search handles objects in memory. (CVE-2017-8620) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. (CLFS) is a high-performance, general-purpose log file subsystem that dedicated client applications can use and multiple clients can share to optimize log access. (CVE-2017-8624) - This security update resolves a vulnerability in Windows Error Reporting (WER). The vulnerability could allow elevation of privilege if successfully exploited by an attacker. An attacker who successfully exploited this vulnerability could gain greater access to sensitive information and system functionality. This update corrects the way the WER handles and executes files. (CVE-2017-8633) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8635) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8636) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8641) - A remote code execution vulnerability exists when Microsoft browsers improperly access objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8653) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2017-8664) - An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8666) - An information disclosure vulnerability exists when the Volume Manager Extension Driver component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system.To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.The security update addresses the vulnerability by correcting how Volume Manager Extension Driver handles objects in memory. (CVE-2017-8668) - A remote code execution vulnerability exists in the way Microsoft browsers handle objects in memory while rendering content. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-8669)
    last seen2020-06-01
    modified2020-06-02
    plugin id102270
    published2017-08-08
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102270
    titleWindows 8.1 and Windows Server 2012 R2 August 2017 Security Updates
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(102270);
      script_version("1.13");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id(
        "CVE-2017-0174",
        "CVE-2017-0250",
        "CVE-2017-0293",
        "CVE-2017-8591",
        "CVE-2017-8593",
        "CVE-2017-8620",
        "CVE-2017-8624",
        "CVE-2017-8633",
        "CVE-2017-8635",
        "CVE-2017-8636",
        "CVE-2017-8641",
        "CVE-2017-8653",
        "CVE-2017-8664",
        "CVE-2017-8666",
        "CVE-2017-8668",
        "CVE-2017-8669"
      );
      script_bugtraq_id(
        98100,
        99430,
        100032,
        100034,
        100038,
        100039,
        100055,
        100056,
        100057,
        100059,
        100061,
        100068,
        100069,
        100085,
        100089,
        100092
      );
      script_xref(name:"MSKB", value:"4034681");
      script_xref(name:"MSFT", value:"MS17-4034681");
      script_xref(name:"MSKB", value:"4034672");
      script_xref(name:"MSFT", value:"MS17-4034672");
    
      script_name(english:"Windows 8.1 and Windows Server 2012 R2 August 2017 Security Updates");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4034672
    or cumulative update 4034681. It is, therefore, affected by
    multiple vulnerabilities :
    
      - A denial of service vulnerability exists when Microsoft
        Windows improperly handles NetBIOS packets. An attacker
        who successfully exploited this vulnerability could
        cause a target computer to become completely
        unresponsive. A remote unauthenticated attacker could
        exploit this vulnerability by sending a series of TCP
        packets to a target system, resulting in a permanent
        denial of service condition. The update addresses the
        vulnerability by correcting how the Windows network
        stack handles NetBIOS traffic. (CVE-2017-0174)
    
      - A buffer overflow vulnerability exists in the Microsoft
        JET Database Engine that could allow remote code
        execution on an affected system. An attacker who
        successfully exploited this vulnerability could take
        complete control of an affected system. An attacker
        could then install programs; view, change, or delete
        data; or create new accounts with full user rights.
        (CVE-2017-0250)
    
      - A remote code execution vulnerability exists when
        Microsoft Windows PDF Library improperly handles objects
        in memory. The vulnerability could corrupt memory in a
        way that enables an attacker to execute arbitrary code
        in the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user. (CVE-2017-0293)
    
      - A remote code execution vulnerability exists in Windows
        Input Method Editor (IME) when IME improperly handles
        parameters in a method of a DCOM class. The DCOM server
        is a Windows component installed regardless of which
        languages/IMEs are enabled. An attacker can instantiate
        the DCOM class and exploit the system even if IME is not
        enabled. (CVE-2017-8591)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights. (CVE-2017-8593)
    
      - A remote code execution vulnerability exists when
        Windows Search handles objects in memory. An attacker
        who successfully exploited this vulnerability could take
        control of the affected system. An attacker could then
        install programs; view, change, or delete data; or
        create new accounts with full user rights.To exploit the
        vulnerability, the attacker could send specially crafted
        messages to the Windows Search service. An attacker with
        access to a target computer could exploit this
        vulnerability to elevate privileges and take control of
        the computer. Additionally, in an enterprise scenario, a
        remote unauthenticated attacker could remotely trigger
        the vulnerability through an SMB connection and then
        take control of a target computer.The security update
        addresses the vulnerability by correcting how Windows
        Search handles objects in memory. (CVE-2017-8620)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. (CLFS) is a high-performance,
        general-purpose log file subsystem that dedicated client
        applications can use and multiple clients can share to
        optimize log access. (CVE-2017-8624)
    
      - This security update resolves a vulnerability in Windows
        Error Reporting (WER). The vulnerability could allow
        elevation of privilege if successfully exploited by an
        attacker. An attacker who successfully exploited this
        vulnerability could gain greater access to sensitive
        information and system functionality. This update
        corrects the way the WER handles and executes files.
        (CVE-2017-8633)
    
      - A remote code execution vulnerability exists in the way
        JavaScript engines render when handling objects in
        memory in Microsoft browsers. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user. (CVE-2017-8635)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browser JavaScript engines render content
        when handling objects in memory. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. (CVE-2017-8636)
    
      - A remote code execution vulnerability exists in the way
        JavaScript engines render when handling objects in
        memory in Microsoft browsers. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user. (CVE-2017-8641)
    
      - A remote code execution vulnerability exists when
        Microsoft browsers improperly access objects in memory.
        The vulnerability could corrupt memory in such a way
        that enables an attacker to execute arbitrary code in
        the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user. (CVE-2017-8653)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system. (CVE-2017-8664)
    
      - An information disclosure vulnerability exists when the
        win32k component improperly provides kernel information.
        An attacker who successfully exploited the vulnerability
        could obtain information to further compromise the users
        system. (CVE-2017-8666)
    
      - An information disclosure vulnerability exists when the
        Volume Manager Extension Driver component improperly
        provides kernel information. An attacker who
        successfully exploited the vulnerability could obtain
        information to further compromise the users system.To
        exploit this vulnerability, an attacker would have to
        log on to an affected system and run a specially crafted
        application.The security update addresses the
        vulnerability by correcting how Volume Manager Extension
        Driver handles objects in memory. (CVE-2017-8668)
    
      - A remote code execution vulnerability exists in the way
        Microsoft browsers handle objects in memory while
        rendering content. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user. If
        the current user is logged on with administrative user
        rights, an attacker who successfully exploited the
        vulnerability could take control of an affected system.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights. (CVE-2017-8669)");
      # https://support.microsoft.com/en-us/help/4034681/windows-8-1-windows-server-2012-r2-update-kb4034681
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1d4d1833");
      # https://support.microsoft.com/en-us/help/4034672/windows-8-1-windows-server-2012-r2-update-kb4034672
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dcc3ea6d");
      script_set_attribute(attribute:"solution", value:
    "Apply Security Only update KB4034672 or Cumulative update KB4034681.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-8620");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/08/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/08/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/08/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS17-08";
    kbs = make_list('4034681', '4034672');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    # Windows 8 EOL
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Windows 8" >< productname && "8.1" >!< productname)
      audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"6.3",
                       sp:0,
                       rollup_date:"08_2017",
                       bulletin:bulletin,
                       rollup_kb_list:[4034681, 4034672])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_AUG_4034665.NASL
    descriptionThe remote Windows host is missing security update 4034666 or cumulative update 4034665. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists when Microsoft Windows improperly handles NetBIOS packets. An attacker who successfully exploited this vulnerability could cause a target computer to become completely unresponsive. A remote unauthenticated attacker could exploit this vulnerability by sending a series of TCP packets to a target system, resulting in a permanent denial of service condition. The update addresses the vulnerability by correcting how the Windows network stack handles NetBIOS traffic. (CVE-2017-0174) - A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-0250) - A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-0293) - A remote code execution vulnerability exists in Windows Input Method Editor (IME) when IME improperly handles parameters in a method of a DCOM class. The DCOM server is a Windows component installed regardless of which languages/IMEs are enabled. An attacker can instantiate the DCOM class and exploit the system even if IME is not enabled. (CVE-2017-8591) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-8593) - A remote code execution vulnerability exists when Windows Search handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.To exploit the vulnerability, the attacker could send specially crafted messages to the Windows Search service. An attacker with access to a target computer could exploit this vulnerability to elevate privileges and take control of the computer. Additionally, in an enterprise scenario, a remote unauthenticated attacker could remotely trigger the vulnerability through an SMB connection and then take control of a target computer.The security update addresses the vulnerability by correcting how Windows Search handles objects in memory. (CVE-2017-8620) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. (CVE-2017-8624) - This security update resolves a vulnerability in Windows Error Reporting (WER). The vulnerability could allow elevation of privilege if successfully exploited by an attacker. An attacker who successfully exploited this vulnerability could gain greater access to sensitive information and system functionality. This update corrects the way the WER handles and executes files. (CVE-2017-8633) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8635) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8636) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8641) - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8651) - A remote code execution vulnerability exists when Microsoft browsers improperly access objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8653) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2017-8664) - An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8666) - An information disclosure vulnerability exists when the Volume Manager Extension Driver component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system.To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.The security update addresses the vulnerability by correcting how Volume Manager Extension Driver handles objects in memory. (CVE-2017-8668)
    last seen2020-06-01
    modified2020-06-02
    plugin id102268
    published2017-08-08
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102268
    titleWindows Server 2012 August 2017 Security Updates
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(102268);
      script_version("1.13");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id(
        "CVE-2017-0174",
        "CVE-2017-0250",
        "CVE-2017-0293",
        "CVE-2017-8591",
        "CVE-2017-8593",
        "CVE-2017-8620",
        "CVE-2017-8624",
        "CVE-2017-8633",
        "CVE-2017-8635",
        "CVE-2017-8636",
        "CVE-2017-8641",
        "CVE-2017-8651",
        "CVE-2017-8653",
        "CVE-2017-8664",
        "CVE-2017-8666",
        "CVE-2017-8668"
      );
      script_bugtraq_id(
        98100,
        99430,
        100032,
        100034,
        100038,
        100039,
        100055,
        100056,
        100057,
        100058,
        100059,
        100061,
        100069,
        100085,
        100089,
        100092
      );
      script_xref(name:"MSKB", value:"4034665");
      script_xref(name:"MSFT", value:"MS17-4034665");
      script_xref(name:"MSKB", value:"4034666");
      script_xref(name:"MSFT", value:"MS17-4034666");
    
      script_name(english:"Windows Server 2012 August 2017 Security Updates");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4034666
    or cumulative update 4034665. It is, therefore, affected by
    multiple vulnerabilities :
    
      - A denial of service vulnerability exists when Microsoft
        Windows improperly handles NetBIOS packets. An attacker
        who successfully exploited this vulnerability could
        cause a target computer to become completely
        unresponsive. A remote unauthenticated attacker could
        exploit this vulnerability by sending a series of TCP
        packets to a target system, resulting in a permanent
        denial of service condition. The update addresses the
        vulnerability by correcting how the Windows network
        stack handles NetBIOS traffic. (CVE-2017-0174)
    
      - A buffer overflow vulnerability exists in the Microsoft
        JET Database Engine that could allow remote code
        execution on an affected system. An attacker who
        successfully exploited this vulnerability could take
        complete control of an affected system. An attacker
        could then install programs; view, change, or delete
        data; or create new accounts with full user rights.
        (CVE-2017-0250)
    
      - A remote code execution vulnerability exists when
        Microsoft Windows PDF Library improperly handles objects
        in memory. The vulnerability could corrupt memory in a
        way that enables an attacker to execute arbitrary code
        in the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user. (CVE-2017-0293)
    
      - A remote code execution vulnerability exists in Windows
        Input Method Editor (IME) when IME improperly handles
        parameters in a method of a DCOM class. The DCOM server
        is a Windows component installed regardless of which
        languages/IMEs are enabled. An attacker can instantiate
        the DCOM class and exploit the system even if IME is not
        enabled. (CVE-2017-8591)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights. (CVE-2017-8593)
    
      - A remote code execution vulnerability exists when
        Windows Search handles objects in memory. An attacker
        who successfully exploited this vulnerability could take
        control of the affected system. An attacker could then
        install programs; view, change, or delete data; or
        create new accounts with full user rights.To exploit the
        vulnerability, the attacker could send specially crafted
        messages to the Windows Search service. An attacker with
        access to a target computer could exploit this
        vulnerability to elevate privileges and take control of
        the computer. Additionally, in an enterprise scenario, a
        remote unauthenticated attacker could remotely trigger
        the vulnerability through an SMB connection and then
        take control of a target computer.The security update
        addresses the vulnerability by correcting how Windows
        Search handles objects in memory. (CVE-2017-8620)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. (CVE-2017-8624)
    
      - This security update resolves a vulnerability in Windows
        Error Reporting (WER). The vulnerability could allow
        elevation of privilege if successfully exploited by an
        attacker. An attacker who successfully exploited this
        vulnerability could gain greater access to sensitive
        information and system functionality. This update
        corrects the way the WER handles and executes files.
        (CVE-2017-8633)
    
      - A remote code execution vulnerability exists in the way
        JavaScript engines render when handling objects in
        memory in Microsoft browsers. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user. (CVE-2017-8635)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browser JavaScript engines render content
        when handling objects in memory. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. (CVE-2017-8636)
    
      - A remote code execution vulnerability exists in the way
        JavaScript engines render when handling objects in
        memory in Microsoft browsers. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user. (CVE-2017-8641)
    
      - A remote code execution vulnerability exists when
        Internet Explorer improperly accesses objects in memory.
        The vulnerability could corrupt memory in such a way
        that an attacker could execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user. (CVE-2017-8651)
    
      - A remote code execution vulnerability exists when
        Microsoft browsers improperly access objects in memory.
        The vulnerability could corrupt memory in such a way
        that enables an attacker to execute arbitrary code in
        the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user. (CVE-2017-8653)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system. (CVE-2017-8664)
    
      - An information disclosure vulnerability exists when the
        win32k component improperly provides kernel information.
        An attacker who successfully exploited the vulnerability
        could obtain information to further compromise the users
        system. (CVE-2017-8666)
    
      - An information disclosure vulnerability exists when the
        Volume Manager Extension Driver component improperly
        provides kernel information. An attacker who
        successfully exploited the vulnerability could obtain
        information to further compromise the users system.To
        exploit this vulnerability, an attacker would have to
        log on to an affected system and run a specially crafted
        application.The security update addresses the
        vulnerability by correcting how Volume Manager Extension
        Driver handles objects in memory. (CVE-2017-8668)");
      # https://support.microsoft.com/en-us/help/4034665/windows-server-2012-update-kb4034665
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5a9af664");
      # https://support.microsoft.com/en-us/help/4034666/windows-server-2012-update-kb4034666
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bb07fa4c");
      script_set_attribute(attribute:"solution", value:
    "Apply Security Only update KB4034666 or Cumulative update KB4034665.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-8620");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/08/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/08/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/08/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS17-08";
    kbs = make_list('4034665', '4034666');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win8:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    # Windows 8 EOL
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Windows 8" >< productname) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"6.2",
                       sp:0,
                       rollup_date:"08_2017",
                       bulletin:bulletin,
                       rollup_kb_list:[4034665, 4034666])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_AUG_4034660.NASL
    descriptionThe remote Windows host is missing security update 4034660. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists when Microsoft Windows improperly handles NetBIOS packets. An attacker who successfully exploited this vulnerability could cause a target computer to become completely unresponsive. A remote unauthenticated attacker could exploit this vulnerability by sending a series of TCP packets to a target system, resulting in a permanent denial of service condition. The update addresses the vulnerability by correcting how the Windows network stack handles NetBIOS traffic. (CVE-2017-0174) - A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-0250) - A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-0293) - An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser. An attacker who successfully exploited this vulnerability could gain elevated privileges and break out of the Edge AppContainer sandbox.The vulnerability by itself does not allow arbitrary code to run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (for example a remote code execution vulnerability and another elevation of privilege vulnerability) to take advantage of the elevated privileges when running.The security update addresses the vulnerability by modifying how Microsoft Edge handles sandboxing. (CVE-2017-8503) - A remote code execution vulnerability exists in Windows Input Method Editor (IME) when IME improperly handles parameters in a method of a DCOM class. The DCOM server is a Windows component installed regardless of which languages/IMEs are enabled. An attacker can instantiate the DCOM class and exploit the system even if IME is not enabled. (CVE-2017-8591) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-8593) - A remote code execution vulnerability exists when Windows Search handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.To exploit the vulnerability, the attacker could send specially crafted messages to the Windows Search service. An attacker with access to a target computer could exploit this vulnerability to elevate privileges and take control of the computer. Additionally, in an enterprise scenario, a remote unauthenticated attacker could remotely trigger the vulnerability through an SMB connection and then take control of a target computer.The security update addresses the vulnerability by correcting how Windows Search handles objects in memory. (CVE-2017-8620) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. (CVE-2017-8624) - A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies. The vulnerability could allow an attacker to bypass Device Guard UCMI policies.To exploit the vulnerability, a user could either visit a malicious website or an attacker with access to the system could run a specially crafted application. An attacker could then leverage the vulnerability to run unsigned malicious code as though it were signed by a trusted source.The update addresses the vulnerability by correcting how Internet Explorer validates UMCI policies. (CVE-2017-8625) - This security update resolves a vulnerability in Windows Error Reporting (WER). The vulnerability could allow elevation of privilege if successfully exploited by an attacker. An attacker who successfully exploited this vulnerability could gain greater access to sensitive information and system functionality. This update corrects the way the WER handles and executes files. (CVE-2017-8633) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8635) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8636) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8640) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8641) - An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8644) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8645) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8646) - An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8652) - A remote code execution vulnerability exists when Microsoft browsers improperly access objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8653) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8655) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8657) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2017-8664) - An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8666) - A remote code execution vulnerability exists in the way Microsoft browsers handle objects in memory while rendering content. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-8669) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8671) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8672)
    last seen2020-06-01
    modified2020-06-02
    plugin id102265
    published2017-08-08
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102265
    titleKB4034660: Windows 10 Version 1511 August 2017 Cumulative Update
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_AUG_4034674.NASL
    descriptionThe remote Windows host is missing security update 4034674. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists when Microsoft Windows improperly handles NetBIOS packets. An attacker who successfully exploited this vulnerability could cause a target computer to become completely unresponsive. (CVE-2017-0174) - A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2017-0250) - A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-0293) - An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser. An attacker who successfully exploited this vulnerability could gain elevated privileges and break out of the Edge AppContainer sandbox. (CVE-2017-8503) - A remote code execution vulnerability exists in Windows Input Method Editor (IME) when IME improperly handles parameters in a method of a DCOM class. The DCOM server is a Windows component installed regardless of which languages/IMEs are enabled. An attacker can instantiate the DCOM class and exploit the system even if IME is not enabled. (CVE-2017-8591) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. (CVE-2017-8593) - A remote code execution vulnerability exists when Windows Search handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-8620) - An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles NT pipes. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. (CVE-2017-8622) - A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host server to crash. (CVE-2017-8623) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. (CVE-2017-8624) - A denial of service vulnerability exists when Windows Subsystem for Linux improperly handles objects in memory. An attacker who successfully exploited this vulnerability could cause a denial of service against the local system.A attacker could exploit this vulnerability by running a specially crafted application.The update addresses the vulnerability by correcting how Windows Subsystem for Linux handles objects in memory. (CVE-2017-8627) - This security update resolves a vulnerability in Windows Error Reporting (WER). The vulnerability could allow elevation of privilege if successfully exploited by an attacker. An attacker who successfully exploited this vulnerability could gain greater access to sensitive information and system functionality. This update corrects the way the WER handles and executes files. (CVE-2017-8633) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8634) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8635) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8636) - A security feature bypass vulnerability exists in Microsoft Edge as a result of how memory is accessed in code compiled by the Edge Just-In-Time (JIT) compiler that allows Arbitrary Code Guard (ACG) to be bypassed. (CVE-2017-8637) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8638) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8639) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8640) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8641) - An elevation of privilege vulnerability exists when Microsoft Edge does not properly validate JavaScript under specific conditions, potentially allowing script to run with elevated privileges. (CVE-2017-8642) - An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8644) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8645) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8646) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8647) - A security feature bypass vulnerability exists when Microsoft Edge does not properly enforce same-origin policies, which could allow an attacker to access information from origins outside the current one. In a web-based attack scenario, an attacker could trick a user into loading a webpage with malicious content. (CVE-2017-8650) - An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8652) - A remote code execution vulnerability exists when Microsoft browsers improperly access objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8653) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8655) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8656) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8657) - An information disclosure vulnerability exists when the Chakra scripting engine does not properly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8659) - A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8661) - An information disclosure vulnerability for Microsoft Edge exists as a result of how strings are validated in specific scenarios, which can allow an attacker to read sensitive data from memory and thereby potentially bypass Address Space Layout Randomization (ASLR). (CVE-2017-8662) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2017-8664) - An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8666) - A remote code execution vulnerability exists in the way Microsoft browsers handle objects in memory while rendering content. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8669) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8670) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8671) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8672) - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. (CVE-2017-8673) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8674)
    last seen2020-06-01
    modified2020-06-02
    plugin id102269
    published2017-08-08
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102269
    titleKB4034674: Windows 10 Version 1703 August 2017 Cumulative Update
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_AUG_4034658.NASL
    descriptionThe remote Windows host is missing security update 4034658. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists when Microsoft Windows improperly handles NetBIOS packets. An attacker who successfully exploited this vulnerability could cause a target computer to become completely unresponsive. A remote unauthenticated attacker could exploit this vulnerability by sending a series of TCP packets to a target system, resulting in a permanent denial of service condition. The update addresses the vulnerability by correcting how the Windows network stack handles NetBIOS traffic. (CVE-2017-0174) - A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-0250) - A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-0293) - An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser. An attacker who successfully exploited this vulnerability could gain elevated privileges and break out of the Edge AppContainer sandbox.The vulnerability by itself does not allow arbitrary code to run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (for example a remote code execution vulnerability and another elevation of privilege vulnerability) to take advantage of the elevated privileges when running.The security update addresses the vulnerability by modifying how Microsoft Edge handles sandboxing. (CVE-2017-8503) - A remote code execution vulnerability exists in Windows Input Method Editor (IME) when IME improperly handles parameters in a method of a DCOM class. The DCOM server is a Windows component installed regardless of which languages/IMEs are enabled. An attacker can instantiate the DCOM class and exploit the system even if IME is not enabled. (CVE-2017-8591) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-8593) - A remote code execution vulnerability exists when Windows Search handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.To exploit the vulnerability, the attacker could send specially crafted messages to the Windows Search service. An attacker with access to a target computer could exploit this vulnerability to elevate privileges and take control of the computer. Additionally, in an enterprise scenario, a remote unauthenticated attacker could remotely trigger the vulnerability through an SMB connection and then take control of a target computer.The security update addresses the vulnerability by correcting how Windows Search handles objects in memory. (CVE-2017-8620) - A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host server to crash. (CVE-2017-8623) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory.(CVE-2017-8624) - A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies. The vulnerability could allow an attacker to bypass Device Guard UCMI policies.To exploit the vulnerability, a user could either visit a malicious website or an attacker with access to the system could run a specially crafted application. An attacker could then leverage the vulnerability to run unsigned malicious code as though it were signed by a trusted source.The update addresses the vulnerability by correcting how Internet Explorer validates UMCI policies. (CVE-2017-8625) - This security update resolves a vulnerability in Windows Error Reporting (WER). The vulnerability could allow elevation of privilege if successfully exploited by an attacker. An attacker who successfully exploited this vulnerability could gain greater access to sensitive information and system functionality. This update corrects the way the WER handles and executes files. (CVE-2017-8633) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8635) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8636) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8639) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8640) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8641) - An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8644) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8645) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8646) - An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8652) - A remote code execution vulnerability exists when Microsoft browsers improperly access objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8653) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8655) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8656) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8657) - A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8661) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2017-8664) - An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8666) - A remote code execution vulnerability exists in the way Microsoft browsers handle objects in memory while rendering content. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-8669) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8670) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8671) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. (CVE-2017-8672)
    last seen2020-06-01
    modified2020-06-02
    plugin id102264
    published2017-08-08
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102264
    titleKB4034658: Windows 10 Version 1607 and Windows Server 2016 August 2017 Cumulative Update
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_AUG_4034668.NASL
    descriptionThe remote Windows host is missing security update 4034668. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists when Windows Search handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-8620) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. (CVE-2017-8624) - A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8635, CVE-2017-8641) - An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8666) - A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies. The vulnerability could allow an attacker to bypass Device Guard UMCI policies. (CVE-2017-8625) - A remote code execution vulnerability exists in Windows Input Method Editor (IME) when IME improperly handles parameters in a method of a DCOM class. The DCOM server is a Windows component installed regardless of which languages/IMEs are enabled. An attacker can instantiate the DCOM class and exploit the system even if IME is not enabled. (CVE-2017-8591) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2017-8664) - A denial of service vulnerability exists when Microsoft Windows improperly handles NetBIOS packets. An attacker who successfully exploited this vulnerability could cause a target computer to become completely unresponsive. A remote unauthenticated attacker could exploit this vulnerability by sending a series of TCP packets to a target system, resulting in a permanent denial of service condition. The update addresses the vulnerability by correcting how the Windows network stack handles NetBIOS traffic. (CVE-2017-0174) - A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. (CVE-2017-0250) - A remote code execution vulnerability exists in the way Microsoft browsers handle objects in memory while rendering content. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8669) - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2017-8633) - A remote code execution vulnerability exists when Microsoft browsers improperly access objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8653) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-8593) - A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked &quot;safe for initialization&quot; in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2017-8636, CVE-2017-8640, CVE-2017-8655, CVE-2017-8672) - A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2017-0293) - An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2017-8644, CVE-2017-8652)
    last seen2020-06-01
    modified2020-06-02
    plugin id104382
    published2017-11-03
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104382
    titleKB4034668: Windows 10 August 2017 Cumulative Update

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/143793/GS20170816234628.txt
idPACKETSTORM:143793
last seen2017-08-18
published2017-08-16
reporterGoogle Security Research
sourcehttps://packetstormsecurity.com/files/143793/Microsoft-Edge-Chakra-TryUndeleteProperty-Incorrect-Usage.html
titleMicrosoft Edge Chakra TryUndeleteProperty Incorrect Usage

Seebug

bulletinFamilyexploit
descriptionChakra implemented the reuse of deleted properties of an unordered dictionary object with the following code. ``` bool SimpleDictionaryUnorderedTypeHandler::TryReuseDeletedPropertyIndex( DynamicObject *const object, TPropertyIndex *const propertyIndex) { if(deletedPropertyIndex == PropertyIndexRanges<TPropertyIndex>::NoSlots) { return false; } *propertyIndex = deletedPropertyIndex; deletedPropertyIndex = static_cast<TPropertyIndex>(TaggedInt::ToInt32(object->GetSlot(deletedPropertyIndex))); return true; } bool SimpleDictionaryUnorderedTypeHandle::TryUndeleteProperty( DynamicObject *const object, const TPropertyIndex existingPropertyIndex, TPropertyIndex *const propertyIndex) { ... if(!IsReusablePropertyIndex(existingPropertyIndex)) { return false; } ... const bool reused = TryReuseDeletedPropertyIndex(object, propertyIndex); Assert(reused); ... return true; } BOOL SimpleDictionaryTypeHandlerBase<TPropertyIndex, TMapKey, IsNotExtensibleSupported>::SetPropertyFromDescriptor(DynamicObject* instance, PropertyId propertyId, TPropertyKey propertyKey, SimpleDictionaryPropertyDescriptor<TPropertyIndex>* descriptor, Var value, PropertyOperationFlags flags, PropertyValueInfo* info) { ... if (descriptor->Attributes & PropertyDeleted) { ... if(isUnordered) { TPropertyIndex propertyIndex; if(AsUnordered()->TryUndeleteProperty(instance, descriptor->propertyIndex, &propertyIndex)) { Assert(PropertyRecordStringHashComparer<TMapKey>::Equals(propertyMap->GetKeyAt(propertyIndex), propertyRecord)); descriptor = propertyMap->GetReferenceAt(propertyIndex); } } if (IsNotExtensibleSupported) { bool isForce = (flags & PropertyOperation_Force) != 0; if (!isForce) { if (!this->VerifyIsExtensible(scriptContext, throwIfNotExtensible)) { return FALSE; <<------ (a) } } } ... descriptor->Attributes = PropertyDynamicTypeDefaults; ... } ... } ``` "`TryUndeleteProperty`" is calling "`TryReuseDeletedPropertyIndex`" on the assumption that the return value of it is always true. But if the method exits at (a), "`descriptor->Attributes`" will remain with "`PropertyDeleted`" set, and therefore we can call "`TryUndeleteProperty`" again and again until "`deletedPropertyIndex`" becames "`NoSlots`" which makes "`TryReuseDeletedPropertyIndex`" return false. In the debug build, the PoC hits the assertion "`Assert(reused);`". In the release build, "`propertyIndex`" remains uninitialized, this will cause a memory corruption. ### PoC: ``` const kNumProperties = 100; let o = {}; for (let i = 0; i < kNumProperties; ++i) o['a' + i] = i; Object.preventExtensions(o); // IsNotExtensibleSupported && !this->VerifyIsExtensible for (let i = 0; i < kNumProperties; ++i) delete o['a' + i]; for (let i = 0; i < 0x1000; ++i) o['a0'] = 1; // calling TryUndeleteProperty again again ```
idSSV:96354
last seen2017-11-19
modified2017-08-17
published2017-08-17
reporterRoot
sourcehttps://www.seebug.org/vuldb/ssvid-96354
titleMicrosoft Edge: Chakra: Incorrect usage of TryUndeleteProperty(CVE-2017-8635)