Vulnerabilities > CVE-2018-8170 - Improper Resource Shutdown or Release vulnerability in Microsoft Windows 10 and Windows Server 2016

047910
CVSS 4.4 - MEDIUM
Attack vector
LOCAL
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
local
microsoft
CWE-404
nessus

Summary

An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory, aka "Windows Image Elevation of Privilege Vulnerability." This affects Windows 10, Windows 10 Servers.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Flooding
    An attacker consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow control in management of interactions. Since each request consumes some of the target's resources, if a sufficiently large number of requests must be processed at the same time then the target's resources can be exhausted. The degree to which the attack is successful depends upon the volume of requests in relation to the amount of the resource the target has access to, and other mitigating circumstances such as the target's ability to shift load or acquired additional resources to deal with the depletion. The more protected the resource and the greater the quantity of it that must be consumed, the more resources the attacker may need to have at their disposal. A typical TCP/IP flooding attack is a Distributed Denial-of-Service attack where many machines simultaneously make a large number of requests to a target. Against a target with strong defenses and a large pool of resources, many tens of thousands of attacking machines may be required. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the attacker can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target.
  • Excessive Allocation
    An attacker causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request. For example, using an Integer Attack, the attacker could cause a variable that controls allocation for a request to hold an excessively large value. Excessive allocation of resources can render a service degraded or unavailable to legitimate users and can even lead to crashing of the target.
  • Resource Leak Exposure
    An attacker utilizes a resource leak on the target to deplete the quantity of the resource available to service legitimate requests. Resource leaks most often come in the form of memory leaks where memory is allocated but never released after it has served its purpose, however, theoretically, any other resource that can be reserved can be targeted if the target fails to release the reservation when the reserved resource block is no longer needed. In this attack, the attacker determines what activity results in leaked resources and then triggers that activity on the target. Since some leaks may be small, this may require a large number of requests by the attacker. However, this attack differs from a flooding attack in that the rate of requests is generally not significant. This is because the lost resources due to the leak accumulate until the target is reset, usually by restarting it. Thus, a resource-poor attacker who would be unable to flood the target can still utilize this attack. Resource depletion through leak differs from resource depletion through allocation in that, in the former, the attacker may not be able to control the size of each leaked allocation, but instead allows the leak to accumulate until it is large enough to affect the target's performance. When depleting resources through allocation, the allocated resource may eventually be released by the target so the attack relies on making sure that the allocation size itself is prohibitive of normal operations by the target.

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_MAY_4103727.NASL
    descriptionThe remote Windows host is missing security update 4103727. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-1039) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8178) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8127, CVE-2018-8141) - A remote code execution vulnerability exists in Microsoft COM for Windows when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-0824) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data. An attacker who successfully exploited these vulnerabilities could execute arbitrary code on a target operating system. To exploit these vulnerabilities, an attacker running inside a virtual machine could run a specially crafted application that could cause the Hyper-V host operating system to execute arbitrary code. The update addresses the vulnerabilities by correcting how Windows Hyper-V validates vSMB packet data. (CVE-2018-0961) - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-1025) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122) - A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8123, CVE-2018-8179) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8167) - A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0958, CVE-2018-8129, CVE-2018-8132) - An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2018-1021) - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8174) - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0943, CVE-2018-8130, CVE-2018-8133) - A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy (SOP) restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploited the vulnerability could force the browser to send data that would otherwise be restricted. (CVE-2018-8112) - An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8897) - An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data. (CVE-2018-8145) - A security feature bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0854) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8165) - A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. (CVE-2018-8136) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8124, CVE-2018-8164, CVE-2018-8166) - A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies. The vulnerability could allow an attacker to bypass Device Guard UMCI policies. (CVE-2018-8126) - An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. An attacker who successfully exploited the vulnerability could impersonate processes, interject cross-process communication, or interrupt system functionality. (CVE-2018-8134) - A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET (or .NET core) application. The update addresses the vulnerability by correcting how .NET and .NET Core applications handle XML document processing. (CVE-2018-0765) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-8128, CVE-2018-8137) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0954, CVE-2018-1022) - An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. (CVE-2018-8170)
    last seen2020-06-01
    modified2020-06-02
    plugin id109608
    published2018-05-08
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109608
    titleKB4103727: Windows 10 Version 1709 and Windows Server Version 1709 May 2018 Security Update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(109608);
      script_version("1.12");
      script_cvs_date("Date: 2019/04/08 10:48:58");
    
      script_cve_id(
        "CVE-2018-0765",
        "CVE-2018-0824",
        "CVE-2018-0854",
        "CVE-2018-0943",
        "CVE-2018-0946",
        "CVE-2018-0951",
        "CVE-2018-0953",
        "CVE-2018-0954",
        "CVE-2018-0955",
        "CVE-2018-0958",
        "CVE-2018-0959",
        "CVE-2018-0961",
        "CVE-2018-1021",
        "CVE-2018-1022",
        "CVE-2018-1025",
        "CVE-2018-1039",
        "CVE-2018-8112",
        "CVE-2018-8114",
        "CVE-2018-8122",
        "CVE-2018-8123",
        "CVE-2018-8124",
        "CVE-2018-8126",
        "CVE-2018-8127",
        "CVE-2018-8128",
        "CVE-2018-8129",
        "CVE-2018-8130",
        "CVE-2018-8132",
        "CVE-2018-8133",
        "CVE-2018-8134",
        "CVE-2018-8136",
        "CVE-2018-8137",
        "CVE-2018-8141",
        "CVE-2018-8145",
        "CVE-2018-8164",
        "CVE-2018-8165",
        "CVE-2018-8166",
        "CVE-2018-8167",
        "CVE-2018-8170",
        "CVE-2018-8174",
        "CVE-2018-8178",
        "CVE-2018-8179",
        "CVE-2018-8897"
      );
      script_xref(name:"MSKB", value:"4103727");
      script_xref(name:"MSFT", value:"MS18-4103727");
    
      script_name(english:"KB4103727: Windows 10 Version 1709 and Windows Server Version 1709 May 2018 Security Update");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4103727.
    It is, therefore, affected by multiple vulnerabilities :
    
      - A security feature bypass vulnerability exists in .Net
        Framework which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-1039)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8178)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8127, CVE-2018-8141)
    
      - A remote code execution vulnerability exists in
        Microsoft COM for Windows when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-0824)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate vSMB packet data. An attacker who successfully
        exploited these vulnerabilities could execute arbitrary
        code on a target operating system. To exploit these
        vulnerabilities, an attacker running inside a virtual
        machine could run a specially crafted application that
        could cause the Hyper-V host operating system to execute
        arbitrary code. The update addresses the vulnerabilities
        by correcting how Windows Hyper-V validates vSMB packet
        data. (CVE-2018-0961)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could obtain information to further
        compromise the users system.  (CVE-2018-1025)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)
    
      - A remote code execution vulnerability exists when
        Microsoft Edge improperly accesses objects in memory.
        The vulnerability could corrupt memory in such a way
        that enables an attacker to execute arbitrary code in
        the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8123,
        CVE-2018-8179)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8167)
    
      - A security feature bypass vulnerability exists in
        Windows which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-0958,
        CVE-2018-8129, CVE-2018-8132)
    
      - An information disclosure vulnerability exists when
        Microsoft Edge improperly handles objects in memory. An
        attacker who successfully exploited the vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-1021)
    
      - A remote code execution vulnerability exists in the way
        that the VBScript engine handles objects in memory. The
        vulnerability could corrupt memory in such a way that an
        attacker could execute arbitrary code in the context of
        the current user. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8174)
    
      - A remote code execution vulnerability exists in the way
        that the Chakra scripting engine handles objects in
        memory in Microsoft Edge. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2018-0943, CVE-2018-8130,
        CVE-2018-8133)
    
      - A security feature bypass vulnerability exists when
        Microsoft Edge improperly handles requests of different
        origins. The vulnerability allows Microsoft Edge to
        bypass Same-Origin Policy (SOP) restrictions, and to
        allow requests that should otherwise be ignored. An
        attacker who successfully exploited the vulnerability
        could force the browser to send data that would
        otherwise be restricted.  (CVE-2018-8112)
    
      - An elevation of privilege vulnerability exists when the
        Windows kernel fails to properly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could run arbitrary code in kernel mode.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights.  (CVE-2018-8897)
    
      - An information disclosure vulnerability exists when
        Chakra improperly discloses the contents of its memory,
        which could provide an attacker with information to
        further compromise the users computer or data.
        (CVE-2018-8145)
    
      - A security feature bypass vulnerability exists in
        Windows Scripting Host which could allow an attacker to
        bypass Device Guard. An attacker who successfully
        exploited this vulnerability could circumvent a User
        Mode Code Integrity (UMCI) policy on the machine.
        (CVE-2018-0854)
    
      - An elevation of privilege vulnerability exists when the
        DirectX Graphics Kernel (DXGKRNL) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8165)
    
      - A remote code execution vulnerability exists in the way
        that Windows handles objects in memory. An attacker who
        successfully exploited the vulnerability could execute
        arbitrary code with elevated permissions on a target
        system.  (CVE-2018-8136)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system.  (CVE-2018-0959)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8124, CVE-2018-8164,
        CVE-2018-8166)
    
      - A security feature bypass vulnerability exists when
        Internet Explorer fails to validate User Mode Code
        Integrity (UMCI) policies. The vulnerability could allow
        an attacker to bypass Device Guard UMCI policies.
        (CVE-2018-8126)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows Kernel API enforces permissions. An
        attacker who successfully exploited the vulnerability
        could impersonate processes, interject cross-process
        communication, or interrupt system functionality.
        (CVE-2018-8134)
    
      - A denial of service vulnerability exists when .NET and
        .NET Core improperly process XML documents. An attacker
        who successfully exploited this vulnerability could
        cause a denial of service against a .NET application. A
        remote unauthenticated attacker could exploit this
        vulnerability by issuing specially crafted requests to a
        .NET (or .NET core) application. The update addresses
        the vulnerability by correcting how .NET and .NET Core
        applications handle XML document processing.
        (CVE-2018-0765)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Microsoft Edge. The vulnerability could corrupt memory
        in such a way that an attacker could execute arbitrary
        code in the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-0946,
        CVE-2018-0951, CVE-2018-0953, CVE-2018-8128,
        CVE-2018-8137)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0954, CVE-2018-1022)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows kernel image handles objects in
        memory. An attacker who successfully exploited the
        vulnerability could execute code with elevated
        permissions.  (CVE-2018-8170)");
      # https://support.microsoft.com/en-us/help/4103727/windows-10-update-kb4103727
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?41c43cb2");
      script_set_attribute(attribute:"solution", value:
      "Apply Cumulative Update KB4103727.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8136");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-05";
    kbs = make_list('4103727');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"10",
                       sp:0,
                       os_build:"16299",
                       rollup_date:"05_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4103727])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_MAY_4103731.NASL
    descriptionThe remote Windows host is missing security update 4103731. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-1039) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8178) - A remote code execution vulnerability exists in Microsoft COM for Windows when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-0824) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data. An attacker who successfully exploited these vulnerabilities could execute arbitrary code on a target operating system. To exploit these vulnerabilities, an attacker running inside a virtual machine could run a specially crafted application that could cause the Hyper-V host operating system to execute arbitrary code. The update addresses the vulnerabilities by correcting how Windows Hyper-V validates vSMB packet data. (CVE-2018-0961) - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-1025) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8167) - A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0958, CVE-2018-8129, CVE-2018-8132) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8127) - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8174) - A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy (SOP) restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploited the vulnerability could force the browser to send data that would otherwise be restricted. (CVE-2018-8112) - A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET (or .NET core) application. The update addresses the vulnerability by correcting how .NET and .NET Core applications handle XML document processing. (CVE-2018-0765) - An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8897) - An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data. (CVE-2018-8145) - A security feature bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0854) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8165) - A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. (CVE-2018-8136) - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0943, CVE-2018-8133) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8124, CVE-2018-8164, CVE-2018-8166) - A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies. The vulnerability could allow an attacker to bypass Device Guard UMCI policies. (CVE-2018-8126) - An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. An attacker who successfully exploited the vulnerability could impersonate processes, interject cross-process communication, or interrupt system functionality. (CVE-2018-8134) - A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8179) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-8128, CVE-2018-8137) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0954, CVE-2018-1022) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959) - An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. (CVE-2018-8170)
    last seen2020-06-01
    modified2020-06-02
    plugin id109611
    published2018-05-08
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109611
    titleKB4103731: Windows 10 Version 1703 May 2018 Security Update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(109611);
      script_version("1.11");
      script_cvs_date("Date: 2019/11/08");
    
      script_cve_id(
        "CVE-2018-0765",
        "CVE-2018-0824",
        "CVE-2018-0854",
        "CVE-2018-0943",
        "CVE-2018-0946",
        "CVE-2018-0951",
        "CVE-2018-0953",
        "CVE-2018-0954",
        "CVE-2018-0955",
        "CVE-2018-0958",
        "CVE-2018-0959",
        "CVE-2018-0961",
        "CVE-2018-1022",
        "CVE-2018-1025",
        "CVE-2018-1039",
        "CVE-2018-8112",
        "CVE-2018-8114",
        "CVE-2018-8122",
        "CVE-2018-8124",
        "CVE-2018-8126",
        "CVE-2018-8127",
        "CVE-2018-8128",
        "CVE-2018-8129",
        "CVE-2018-8132",
        "CVE-2018-8133",
        "CVE-2018-8134",
        "CVE-2018-8136",
        "CVE-2018-8137",
        "CVE-2018-8145",
        "CVE-2018-8164",
        "CVE-2018-8165",
        "CVE-2018-8166",
        "CVE-2018-8167",
        "CVE-2018-8170",
        "CVE-2018-8174",
        "CVE-2018-8178",
        "CVE-2018-8179",
        "CVE-2018-8897"
      );
      script_xref(name:"MSKB", value:"4103731");
      script_xref(name:"MSFT", value:"MS18-4103731");
    
      script_name(english:"KB4103731: Windows 10 Version 1703 May 2018 Security Update");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4103731.
    It is, therefore, affected by multiple vulnerabilities :
    
      - A security feature bypass vulnerability exists in .Net
        Framework which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-1039)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8178)
    
      - A remote code execution vulnerability exists in
        Microsoft COM for Windows when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-0824)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate vSMB packet data. An attacker who successfully
        exploited these vulnerabilities could execute arbitrary
        code on a target operating system. To exploit these
        vulnerabilities, an attacker running inside a virtual
        machine could run a specially crafted application that
        could cause the Hyper-V host operating system to execute
        arbitrary code. The update addresses the vulnerabilities
        by correcting how Windows Hyper-V validates vSMB packet
        data. (CVE-2018-0961)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could obtain information to further
        compromise the users system.  (CVE-2018-1025)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8167)
    
      - A security feature bypass vulnerability exists in
        Windows which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-0958,
        CVE-2018-8129, CVE-2018-8132)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8127)
    
      - A remote code execution vulnerability exists in the way
        that the VBScript engine handles objects in memory. The
        vulnerability could corrupt memory in such a way that an
        attacker could execute arbitrary code in the context of
        the current user. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8174)
    
      - A security feature bypass vulnerability exists when
        Microsoft Edge improperly handles requests of different
        origins. The vulnerability allows Microsoft Edge to
        bypass Same-Origin Policy (SOP) restrictions, and to
        allow requests that should otherwise be ignored. An
        attacker who successfully exploited the vulnerability
        could force the browser to send data that would
        otherwise be restricted.  (CVE-2018-8112)
    
      - A denial of service vulnerability exists when .NET and
        .NET Core improperly process XML documents. An attacker
        who successfully exploited this vulnerability could
        cause a denial of service against a .NET application. A
        remote unauthenticated attacker could exploit this
        vulnerability by issuing specially crafted requests to a
        .NET (or .NET core) application. The update addresses
        the vulnerability by correcting how .NET and .NET Core
        applications handle XML document processing.
        (CVE-2018-0765)
    
      - An elevation of privilege vulnerability exists when the
        Windows kernel fails to properly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could run arbitrary code in kernel mode.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights.  (CVE-2018-8897)
    
      - An information disclosure vulnerability exists when
        Chakra improperly discloses the contents of its memory,
        which could provide an attacker with information to
        further compromise the users computer or data.
        (CVE-2018-8145)
    
      - A security feature bypass vulnerability exists in
        Windows Scripting Host which could allow an attacker to
        bypass Device Guard. An attacker who successfully
        exploited this vulnerability could circumvent a User
        Mode Code Integrity (UMCI) policy on the machine.
        (CVE-2018-0854)
    
      - An elevation of privilege vulnerability exists when the
        DirectX Graphics Kernel (DXGKRNL) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8165)
    
      - A remote code execution vulnerability exists in the way
        that Windows handles objects in memory. An attacker who
        successfully exploited the vulnerability could execute
        arbitrary code with elevated permissions on a target
        system.  (CVE-2018-8136)
    
      - A remote code execution vulnerability exists in the way
        that the Chakra scripting engine handles objects in
        memory in Microsoft Edge. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2018-0943, CVE-2018-8133)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8124, CVE-2018-8164,
        CVE-2018-8166)
    
      - A security feature bypass vulnerability exists when
        Internet Explorer fails to validate User Mode Code
        Integrity (UMCI) policies. The vulnerability could allow
        an attacker to bypass Device Guard UMCI policies.
        (CVE-2018-8126)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows Kernel API enforces permissions. An
        attacker who successfully exploited the vulnerability
        could impersonate processes, interject cross-process
        communication, or interrupt system functionality.
        (CVE-2018-8134)
    
      - A remote code execution vulnerability exists when
        Microsoft Edge improperly accesses objects in memory.
        The vulnerability could corrupt memory in such a way
        that enables an attacker to execute arbitrary code in
        the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8179)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Microsoft Edge. The vulnerability could corrupt memory
        in such a way that an attacker could execute arbitrary
        code in the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-0946,
        CVE-2018-0951, CVE-2018-0953, CVE-2018-8128,
        CVE-2018-8137)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0954, CVE-2018-1022)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system.  (CVE-2018-0959)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows kernel image handles objects in
        memory. An attacker who successfully exploited the
        vulnerability could execute code with elevated
        permissions.  (CVE-2018-8170)");
      # https://support.microsoft.com/en-us/help/4103731/windows-10-update-kb4103731
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e6fc001a");
      script_set_attribute(attribute:"solution", value:
    "Apply Cumulative Update KB4103731.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8136");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-05";
    kbs = make_list('4103731');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"10",
                       sp:0,
                       os_build:"15063",
                       rollup_date:"05_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4103731])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    

The Hacker News

idTHN:8ECA2639341E23BD24E0C06DE0556482
last seen2018-05-09
modified2018-05-09
published2018-05-09
reporterSwati Khandelwal
sourcehttps://thehackernews.com/2018/05/microsoft-patch-tuesday.html
titleMicrosoft Patches Two Zero-Day Flaws Under Active Attack