Vulnerabilities > CVE-2018-8174 - Out-of-bounds Write vulnerability in Microsoft products

047910
CVSS 7.6 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
high complexity
microsoft
CWE-787
nessus
exploit available

Summary

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionMicrosoft Internet Explorer 11 (Windows 7 x64/x86) - vbscript Code Execution. CVE-2018-8174. Local exploit for Windows platform
fileexploits/windows/local/44741.html
idEDB-ID:44741
last seen2018-05-24
modified2018-05-21
platformwindows
port
published2018-05-21
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/44741/
titleMicrosoft Internet Explorer 11 (Windows 7 x64/x86) - vbscript Code Execution
typelocal

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_MAY_4103721.NASL
    descriptionThe remote Windows host is missing security update 4103721. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-1039) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8178) - A remote code execution vulnerability exists in Microsoft COM for Windows when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-0824) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data. An attacker who successfully exploited these vulnerabilities could execute arbitrary code on a target operating system. To exploit these vulnerabilities, an attacker running inside a virtual machine could run a specially crafted application that could cause the Hyper-V host operating system to execute arbitrary code. The update addresses the vulnerabilities by correcting how Windows Hyper-V validates vSMB packet data. (CVE-2018-0961) - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-1025) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8167) - A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0958, CVE-2018-8129, CVE-2018-8132) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8127) - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8174) - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0943, CVE-2018-8130, CVE-2018-8133) - A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy (SOP) restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploited the vulnerability could force the browser to send data that would otherwise be restricted. (CVE-2018-8112) - A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET (or .NET core) application. The update addresses the vulnerability by correcting how .NET and .NET Core applications handle XML document processing. (CVE-2018-0765) - An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8897) - An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data. (CVE-2018-8145) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8165) - A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. (CVE-2018-8136) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8124, CVE-2018-8164, CVE-2018-8166) - A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies. The vulnerability could allow an attacker to bypass Device Guard UMCI policies. (CVE-2018-8126) - An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. An attacker who successfully exploited the vulnerability could impersonate processes, interject cross-process communication, or interrupt system functionality. (CVE-2018-8134) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0954, CVE-2018-1022) - A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8179) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0945, CVE-2018-0946, CVE-2018-0953, CVE-2018-8128, CVE-2018-8137, CVE-2018-8139)
    last seen2020-06-01
    modified2020-06-02
    plugin id109605
    published2018-05-08
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109605
    titleKB4103721: Windows 10 Version 1803 and Windows Server Version 1803 May 2018 Security Update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(109605);
      script_version("1.12");
      script_cvs_date("Date: 2019/04/08 10:48:58");
    
      script_cve_id(
        "CVE-2018-0765",
        "CVE-2018-0824",
        "CVE-2018-0943",
        "CVE-2018-0945",
        "CVE-2018-0946",
        "CVE-2018-0953",
        "CVE-2018-0954",
        "CVE-2018-0955",
        "CVE-2018-0958",
        "CVE-2018-0959",
        "CVE-2018-0961",
        "CVE-2018-1022",
        "CVE-2018-1025",
        "CVE-2018-1039",
        "CVE-2018-8112",
        "CVE-2018-8114",
        "CVE-2018-8122",
        "CVE-2018-8124",
        "CVE-2018-8126",
        "CVE-2018-8127",
        "CVE-2018-8128",
        "CVE-2018-8129",
        "CVE-2018-8130",
        "CVE-2018-8132",
        "CVE-2018-8133",
        "CVE-2018-8134",
        "CVE-2018-8136",
        "CVE-2018-8137",
        "CVE-2018-8139",
        "CVE-2018-8145",
        "CVE-2018-8164",
        "CVE-2018-8165",
        "CVE-2018-8166",
        "CVE-2018-8167",
        "CVE-2018-8174",
        "CVE-2018-8178",
        "CVE-2018-8179",
        "CVE-2018-8897"
      );
      script_xref(name:"MSKB", value:"4103721");
      script_xref(name:"MSFT", value:"MS18-4103721");
    
      script_name(english:"KB4103721: Windows 10 Version 1803 and Windows Server Version 1803 May 2018 Security Update");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4103721.
    It is, therefore, affected by multiple vulnerabilities :
    
      - A security feature bypass vulnerability exists in .Net
        Framework which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-1039)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8178)
    
      - A remote code execution vulnerability exists in
        Microsoft COM for Windows when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-0824)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate vSMB packet data. An attacker who successfully
        exploited these vulnerabilities could execute arbitrary
        code on a target operating system. To exploit these
        vulnerabilities, an attacker running inside a virtual
        machine could run a specially crafted application that
        could cause the Hyper-V host operating system to execute
        arbitrary code. The update addresses the vulnerabilities
        by correcting how Windows Hyper-V validates vSMB packet
        data. (CVE-2018-0961)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could obtain information to further
        compromise the users system.  (CVE-2018-1025)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8167)
    
      - A security feature bypass vulnerability exists in
        Windows which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-0958,
        CVE-2018-8129, CVE-2018-8132)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8127)
    
      - A remote code execution vulnerability exists in the way
        that the VBScript engine handles objects in memory. The
        vulnerability could corrupt memory in such a way that an
        attacker could execute arbitrary code in the context of
        the current user. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8174)
    
      - A remote code execution vulnerability exists in the way
        that the Chakra scripting engine handles objects in
        memory in Microsoft Edge. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2018-0943, CVE-2018-8130,
        CVE-2018-8133)
    
      - A security feature bypass vulnerability exists when
        Microsoft Edge improperly handles requests of different
        origins. The vulnerability allows Microsoft Edge to
        bypass Same-Origin Policy (SOP) restrictions, and to
        allow requests that should otherwise be ignored. An
        attacker who successfully exploited the vulnerability
        could force the browser to send data that would
        otherwise be restricted.  (CVE-2018-8112)
    
      - A denial of service vulnerability exists when .NET and
        .NET Core improperly process XML documents. An attacker
        who successfully exploited this vulnerability could
        cause a denial of service against a .NET application. A
        remote unauthenticated attacker could exploit this
        vulnerability by issuing specially crafted requests to a
        .NET (or .NET core) application. The update addresses
        the vulnerability by correcting how .NET and .NET Core
        applications handle XML document processing.
        (CVE-2018-0765)
    
      - An elevation of privilege vulnerability exists when the
        Windows kernel fails to properly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could run arbitrary code in kernel mode.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights.  (CVE-2018-8897)
    
      - An information disclosure vulnerability exists when
        Chakra improperly discloses the contents of its memory,
        which could provide an attacker with information to
        further compromise the users computer or data.
        (CVE-2018-8145)
    
      - An elevation of privilege vulnerability exists when the
        DirectX Graphics Kernel (DXGKRNL) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8165)
    
      - A remote code execution vulnerability exists in the way
        that Windows handles objects in memory. An attacker who
        successfully exploited the vulnerability could execute
        arbitrary code with elevated permissions on a target
        system.  (CVE-2018-8136)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system.  (CVE-2018-0959)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8124, CVE-2018-8164,
        CVE-2018-8166)
    
      - A security feature bypass vulnerability exists when
        Internet Explorer fails to validate User Mode Code
        Integrity (UMCI) policies. The vulnerability could allow
        an attacker to bypass Device Guard UMCI policies.
        (CVE-2018-8126)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows Kernel API enforces permissions. An
        attacker who successfully exploited the vulnerability
        could impersonate processes, interject cross-process
        communication, or interrupt system functionality.
        (CVE-2018-8134)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0954, CVE-2018-1022)
    
      - A remote code execution vulnerability exists when
        Microsoft Edge improperly accesses objects in memory.
        The vulnerability could corrupt memory in such a way
        that enables an attacker to execute arbitrary code in
        the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8179)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Microsoft Edge. The vulnerability could corrupt memory
        in such a way that an attacker could execute arbitrary
        code in the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-0945,
        CVE-2018-0946, CVE-2018-0953, CVE-2018-8128,
        CVE-2018-8137, CVE-2018-8139)");
      # https://support.microsoft.com/en-us/help/4103721/windows-10-update-kb4103721
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9d0d5cd2");
      script_set_attribute(attribute:"solution", value:
      "Apply Cumulative Update KB4103721.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8136");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-05";
    kbs = make_list('4103721');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"10",
                       sp:0,
                       os_build:"17134",
                       rollup_date:"05_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4103721])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_MAY_4103725.NASL
    descriptionThe remote Windows host is missing security update 4103715 or cumulative update 4103725. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8897) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8178) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0954, CVE-2018-1022) - A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-1039) - An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data. (CVE-2018-8145) - A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. (CVE-2018-8136) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8127) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8167) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959) - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-1025) - A remote code execution vulnerability exists in Microsoft COM for Windows when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-0824) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122) - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8174) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8124, CVE-2018-8164, CVE-2018-8166) - An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. An attacker who successfully exploited the vulnerability could impersonate processes, interject cross-process communication, or interrupt system functionality. (CVE-2018-8134) - A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET (or .NET core) application. The update addresses the vulnerability by correcting how .NET and .NET Core applications handle XML document processing. (CVE-2018-0765)
    last seen2020-06-01
    modified2020-06-02
    plugin id109607
    published2018-05-08
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109607
    titleKB4103715: Windows 8.1 and Windows Server 2012 R2 May 2018 Security Update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(109607);
      script_version("1.10");
      script_cvs_date("Date: 2019/11/08");
    
      script_cve_id(
        "CVE-2018-0765",
        "CVE-2018-0824",
        "CVE-2018-0954",
        "CVE-2018-0955",
        "CVE-2018-0959",
        "CVE-2018-1022",
        "CVE-2018-1025",
        "CVE-2018-1039",
        "CVE-2018-8114",
        "CVE-2018-8122",
        "CVE-2018-8124",
        "CVE-2018-8127",
        "CVE-2018-8134",
        "CVE-2018-8136",
        "CVE-2018-8145",
        "CVE-2018-8164",
        "CVE-2018-8166",
        "CVE-2018-8167",
        "CVE-2018-8174",
        "CVE-2018-8178",
        "CVE-2018-8897"
      );
      script_xref(name:"MSKB", value:"4103715");
      script_xref(name:"MSKB", value:"4103725");
      script_xref(name:"MSFT", value:"MS18-4103715");
      script_xref(name:"MSFT", value:"MS18-4103725");
    
      script_name(english:"KB4103715: Windows 8.1 and Windows Server 2012 R2 May 2018 Security Update");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4103715
    or cumulative update 4103725. It is, therefore, affected by
    multiple vulnerabilities :
    
      - An elevation of privilege vulnerability exists when the
        Windows kernel fails to properly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could run arbitrary code in kernel mode.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights.  (CVE-2018-8897)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8178)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0954, CVE-2018-1022)
    
      - A security feature bypass vulnerability exists in .Net
        Framework which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-1039)
    
      - An information disclosure vulnerability exists when
        Chakra improperly discloses the contents of its memory,
        which could provide an attacker with information to
        further compromise the users computer or data.
        (CVE-2018-8145)
    
      - A remote code execution vulnerability exists in the way
        that Windows handles objects in memory. An attacker who
        successfully exploited the vulnerability could execute
        arbitrary code with elevated permissions on a target
        system.  (CVE-2018-8136)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8127)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8167)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system.  (CVE-2018-0959)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could obtain information to further
        compromise the users system.  (CVE-2018-1025)
    
      - A remote code execution vulnerability exists in
        Microsoft COM for Windows when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-0824)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)
    
      - A remote code execution vulnerability exists in the way
        that the VBScript engine handles objects in memory. The
        vulnerability could corrupt memory in such a way that an
        attacker could execute arbitrary code in the context of
        the current user. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8174)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8124, CVE-2018-8164,
        CVE-2018-8166)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows Kernel API enforces permissions. An
        attacker who successfully exploited the vulnerability
        could impersonate processes, interject cross-process
        communication, or interrupt system functionality.
        (CVE-2018-8134)
    
      - A denial of service vulnerability exists when .NET and
        .NET Core improperly process XML documents. An attacker
        who successfully exploited this vulnerability could
        cause a denial of service against a .NET application. A
        remote unauthenticated attacker could exploit this
        vulnerability by issuing specially crafted requests to a
        .NET (or .NET core) application. The update addresses
        the vulnerability by correcting how .NET and .NET Core
        applications handle XML document processing.
        (CVE-2018-0765)");
      # https://support.microsoft.com/en-us/help/4103715/windows-81-update-kb4103715
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?781c2262");
      # https://support.microsoft.com/en-us/help/4103725/windows-81-update-kb4103725
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dba0079e");
      script_set_attribute(attribute:"solution", value:
    "Apply Security Only update KB4103715 or Cumulative Update KB4103725.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8136");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-05";
    kbs = make_list('4103715', '4103725');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    # Windows 8 EOL
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Windows 8" >< productname && "8.1" >!< productname)
      audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"6.3",
                       sp:0,
                       rollup_date:"05_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4103715, 4103725])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_MAY_4103723.NASL
    descriptionThe remote Windows host is missing security update 4103723. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-1039) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8178) - A remote code execution vulnerability exists in Microsoft COM for Windows when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-0824) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0951, CVE-2018-0953, CVE-2018-8137) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data. An attacker who successfully exploited these vulnerabilities could execute arbitrary code on a target operating system. To exploit these vulnerabilities, an attacker running inside a virtual machine could run a specially crafted application that could cause the Hyper-V host operating system to execute arbitrary code. The update addresses the vulnerabilities by correcting how Windows Hyper-V validates vSMB packet data. (CVE-2018-0961) - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-1025) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8167) - A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0958, CVE-2018-8129, CVE-2018-8132) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8127) - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8174) - A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy (SOP) restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploited the vulnerability could force the browser to send data that would otherwise be restricted. (CVE-2018-8112) - A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET (or .NET core) application. The update addresses the vulnerability by correcting how .NET and .NET Core applications handle XML document processing. (CVE-2018-0765) - An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8897) - An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data. (CVE-2018-8145) - A security feature bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0854) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8165) - A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. (CVE-2018-8136) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8124, CVE-2018-8164, CVE-2018-8166) - A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies. The vulnerability could allow an attacker to bypass Device Guard UMCI policies. (CVE-2018-8126) - An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. An attacker who successfully exploited the vulnerability could impersonate processes, interject cross-process communication, or interrupt system functionality. (CVE-2018-8134) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0954, CVE-2018-1022) - A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8179) - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0943, CVE-2018-8133)
    last seen2020-06-01
    modified2020-06-02
    plugin id109606
    published2018-05-08
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109606
    titleKB4103723: Windows 10 Version 1607 and Windows Server 2016 May 2018 Security Update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(109606);
      script_version("1.11");
      script_cvs_date("Date: 2019/11/08");
    
      script_cve_id(
        "CVE-2018-0765",
        "CVE-2018-0824",
        "CVE-2018-0854",
        "CVE-2018-0943",
        "CVE-2018-0951",
        "CVE-2018-0953",
        "CVE-2018-0954",
        "CVE-2018-0955",
        "CVE-2018-0958",
        "CVE-2018-0959",
        "CVE-2018-0961",
        "CVE-2018-1022",
        "CVE-2018-1025",
        "CVE-2018-1039",
        "CVE-2018-8112",
        "CVE-2018-8114",
        "CVE-2018-8122",
        "CVE-2018-8124",
        "CVE-2018-8126",
        "CVE-2018-8127",
        "CVE-2018-8129",
        "CVE-2018-8132",
        "CVE-2018-8133",
        "CVE-2018-8134",
        "CVE-2018-8136",
        "CVE-2018-8137",
        "CVE-2018-8145",
        "CVE-2018-8164",
        "CVE-2018-8165",
        "CVE-2018-8166",
        "CVE-2018-8167",
        "CVE-2018-8174",
        "CVE-2018-8178",
        "CVE-2018-8179",
        "CVE-2018-8897"
      );
      script_xref(name:"MSKB", value:"4103723");
      script_xref(name:"MSFT", value:"MS18-4103723");
    
      script_name(english:"KB4103723: Windows 10 Version 1607 and Windows Server 2016 May 2018 Security Update");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4103723.
    It is, therefore, affected by multiple vulnerabilities :
    
      - A security feature bypass vulnerability exists in .Net
        Framework which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-1039)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8178)
    
      - A remote code execution vulnerability exists in
        Microsoft COM for Windows when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-0824)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Microsoft Edge. The vulnerability could corrupt memory
        in such a way that an attacker could execute arbitrary
        code in the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-0951,
        CVE-2018-0953, CVE-2018-8137)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate vSMB packet data. An attacker who successfully
        exploited these vulnerabilities could execute arbitrary
        code on a target operating system. To exploit these
        vulnerabilities, an attacker running inside a virtual
        machine could run a specially crafted application that
        could cause the Hyper-V host operating system to execute
        arbitrary code. The update addresses the vulnerabilities
        by correcting how Windows Hyper-V validates vSMB packet
        data. (CVE-2018-0961)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could obtain information to further
        compromise the users system.  (CVE-2018-1025)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8167)
    
      - A security feature bypass vulnerability exists in
        Windows which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-0958,
        CVE-2018-8129, CVE-2018-8132)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8127)
    
      - A remote code execution vulnerability exists in the way
        that the VBScript engine handles objects in memory. The
        vulnerability could corrupt memory in such a way that an
        attacker could execute arbitrary code in the context of
        the current user. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8174)
    
      - A security feature bypass vulnerability exists when
        Microsoft Edge improperly handles requests of different
        origins. The vulnerability allows Microsoft Edge to
        bypass Same-Origin Policy (SOP) restrictions, and to
        allow requests that should otherwise be ignored. An
        attacker who successfully exploited the vulnerability
        could force the browser to send data that would
        otherwise be restricted.  (CVE-2018-8112)
    
      - A denial of service vulnerability exists when .NET and
        .NET Core improperly process XML documents. An attacker
        who successfully exploited this vulnerability could
        cause a denial of service against a .NET application. A
        remote unauthenticated attacker could exploit this
        vulnerability by issuing specially crafted requests to a
        .NET (or .NET core) application. The update addresses
        the vulnerability by correcting how .NET and .NET Core
        applications handle XML document processing.
        (CVE-2018-0765)
    
      - An elevation of privilege vulnerability exists when the
        Windows kernel fails to properly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could run arbitrary code in kernel mode.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights.  (CVE-2018-8897)
    
      - An information disclosure vulnerability exists when
        Chakra improperly discloses the contents of its memory,
        which could provide an attacker with information to
        further compromise the users computer or data.
        (CVE-2018-8145)
    
      - A security feature bypass vulnerability exists in
        Windows Scripting Host which could allow an attacker to
        bypass Device Guard. An attacker who successfully
        exploited this vulnerability could circumvent a User
        Mode Code Integrity (UMCI) policy on the machine.
        (CVE-2018-0854)
    
      - An elevation of privilege vulnerability exists when the
        DirectX Graphics Kernel (DXGKRNL) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8165)
    
      - A remote code execution vulnerability exists in the way
        that Windows handles objects in memory. An attacker who
        successfully exploited the vulnerability could execute
        arbitrary code with elevated permissions on a target
        system.  (CVE-2018-8136)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system.  (CVE-2018-0959)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8124, CVE-2018-8164,
        CVE-2018-8166)
    
      - A security feature bypass vulnerability exists when
        Internet Explorer fails to validate User Mode Code
        Integrity (UMCI) policies. The vulnerability could allow
        an attacker to bypass Device Guard UMCI policies.
        (CVE-2018-8126)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows Kernel API enforces permissions. An
        attacker who successfully exploited the vulnerability
        could impersonate processes, interject cross-process
        communication, or interrupt system functionality.
        (CVE-2018-8134)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0954, CVE-2018-1022)
    
      - A remote code execution vulnerability exists when
        Microsoft Edge improperly accesses objects in memory.
        The vulnerability could corrupt memory in such a way
        that enables an attacker to execute arbitrary code in
        the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8179)
    
      - A remote code execution vulnerability exists in the way
        that the Chakra scripting engine handles objects in
        memory in Microsoft Edge. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2018-0943, CVE-2018-8133)");
      # https://support.microsoft.com/en-us/help/4103723/windows-10-update-kb4103723
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aca51532");
      script_set_attribute(attribute:"solution", value:
    "Apply Cumulative Update KB4103723.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8136");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-05";
    kbs = make_list('4103723');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"10",
                       sp:0,
                       os_build:"14393",
                       rollup_date:"05_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4103723])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_MAY_4103727.NASL
    descriptionThe remote Windows host is missing security update 4103727. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-1039) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8178) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8127, CVE-2018-8141) - A remote code execution vulnerability exists in Microsoft COM for Windows when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-0824) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data. An attacker who successfully exploited these vulnerabilities could execute arbitrary code on a target operating system. To exploit these vulnerabilities, an attacker running inside a virtual machine could run a specially crafted application that could cause the Hyper-V host operating system to execute arbitrary code. The update addresses the vulnerabilities by correcting how Windows Hyper-V validates vSMB packet data. (CVE-2018-0961) - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-1025) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122) - A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8123, CVE-2018-8179) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8167) - A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0958, CVE-2018-8129, CVE-2018-8132) - An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. (CVE-2018-1021) - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8174) - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0943, CVE-2018-8130, CVE-2018-8133) - A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy (SOP) restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploited the vulnerability could force the browser to send data that would otherwise be restricted. (CVE-2018-8112) - An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8897) - An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data. (CVE-2018-8145) - A security feature bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0854) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8165) - A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. (CVE-2018-8136) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8124, CVE-2018-8164, CVE-2018-8166) - A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies. The vulnerability could allow an attacker to bypass Device Guard UMCI policies. (CVE-2018-8126) - An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. An attacker who successfully exploited the vulnerability could impersonate processes, interject cross-process communication, or interrupt system functionality. (CVE-2018-8134) - A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET (or .NET core) application. The update addresses the vulnerability by correcting how .NET and .NET Core applications handle XML document processing. (CVE-2018-0765) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-8128, CVE-2018-8137) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0954, CVE-2018-1022) - An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. (CVE-2018-8170)
    last seen2020-06-01
    modified2020-06-02
    plugin id109608
    published2018-05-08
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109608
    titleKB4103727: Windows 10 Version 1709 and Windows Server Version 1709 May 2018 Security Update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(109608);
      script_version("1.12");
      script_cvs_date("Date: 2019/04/08 10:48:58");
    
      script_cve_id(
        "CVE-2018-0765",
        "CVE-2018-0824",
        "CVE-2018-0854",
        "CVE-2018-0943",
        "CVE-2018-0946",
        "CVE-2018-0951",
        "CVE-2018-0953",
        "CVE-2018-0954",
        "CVE-2018-0955",
        "CVE-2018-0958",
        "CVE-2018-0959",
        "CVE-2018-0961",
        "CVE-2018-1021",
        "CVE-2018-1022",
        "CVE-2018-1025",
        "CVE-2018-1039",
        "CVE-2018-8112",
        "CVE-2018-8114",
        "CVE-2018-8122",
        "CVE-2018-8123",
        "CVE-2018-8124",
        "CVE-2018-8126",
        "CVE-2018-8127",
        "CVE-2018-8128",
        "CVE-2018-8129",
        "CVE-2018-8130",
        "CVE-2018-8132",
        "CVE-2018-8133",
        "CVE-2018-8134",
        "CVE-2018-8136",
        "CVE-2018-8137",
        "CVE-2018-8141",
        "CVE-2018-8145",
        "CVE-2018-8164",
        "CVE-2018-8165",
        "CVE-2018-8166",
        "CVE-2018-8167",
        "CVE-2018-8170",
        "CVE-2018-8174",
        "CVE-2018-8178",
        "CVE-2018-8179",
        "CVE-2018-8897"
      );
      script_xref(name:"MSKB", value:"4103727");
      script_xref(name:"MSFT", value:"MS18-4103727");
    
      script_name(english:"KB4103727: Windows 10 Version 1709 and Windows Server Version 1709 May 2018 Security Update");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4103727.
    It is, therefore, affected by multiple vulnerabilities :
    
      - A security feature bypass vulnerability exists in .Net
        Framework which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-1039)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8178)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8127, CVE-2018-8141)
    
      - A remote code execution vulnerability exists in
        Microsoft COM for Windows when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-0824)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate vSMB packet data. An attacker who successfully
        exploited these vulnerabilities could execute arbitrary
        code on a target operating system. To exploit these
        vulnerabilities, an attacker running inside a virtual
        machine could run a specially crafted application that
        could cause the Hyper-V host operating system to execute
        arbitrary code. The update addresses the vulnerabilities
        by correcting how Windows Hyper-V validates vSMB packet
        data. (CVE-2018-0961)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could obtain information to further
        compromise the users system.  (CVE-2018-1025)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)
    
      - A remote code execution vulnerability exists when
        Microsoft Edge improperly accesses objects in memory.
        The vulnerability could corrupt memory in such a way
        that enables an attacker to execute arbitrary code in
        the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8123,
        CVE-2018-8179)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8167)
    
      - A security feature bypass vulnerability exists in
        Windows which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-0958,
        CVE-2018-8129, CVE-2018-8132)
    
      - An information disclosure vulnerability exists when
        Microsoft Edge improperly handles objects in memory. An
        attacker who successfully exploited the vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-1021)
    
      - A remote code execution vulnerability exists in the way
        that the VBScript engine handles objects in memory. The
        vulnerability could corrupt memory in such a way that an
        attacker could execute arbitrary code in the context of
        the current user. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8174)
    
      - A remote code execution vulnerability exists in the way
        that the Chakra scripting engine handles objects in
        memory in Microsoft Edge. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2018-0943, CVE-2018-8130,
        CVE-2018-8133)
    
      - A security feature bypass vulnerability exists when
        Microsoft Edge improperly handles requests of different
        origins. The vulnerability allows Microsoft Edge to
        bypass Same-Origin Policy (SOP) restrictions, and to
        allow requests that should otherwise be ignored. An
        attacker who successfully exploited the vulnerability
        could force the browser to send data that would
        otherwise be restricted.  (CVE-2018-8112)
    
      - An elevation of privilege vulnerability exists when the
        Windows kernel fails to properly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could run arbitrary code in kernel mode.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights.  (CVE-2018-8897)
    
      - An information disclosure vulnerability exists when
        Chakra improperly discloses the contents of its memory,
        which could provide an attacker with information to
        further compromise the users computer or data.
        (CVE-2018-8145)
    
      - A security feature bypass vulnerability exists in
        Windows Scripting Host which could allow an attacker to
        bypass Device Guard. An attacker who successfully
        exploited this vulnerability could circumvent a User
        Mode Code Integrity (UMCI) policy on the machine.
        (CVE-2018-0854)
    
      - An elevation of privilege vulnerability exists when the
        DirectX Graphics Kernel (DXGKRNL) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8165)
    
      - A remote code execution vulnerability exists in the way
        that Windows handles objects in memory. An attacker who
        successfully exploited the vulnerability could execute
        arbitrary code with elevated permissions on a target
        system.  (CVE-2018-8136)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system.  (CVE-2018-0959)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8124, CVE-2018-8164,
        CVE-2018-8166)
    
      - A security feature bypass vulnerability exists when
        Internet Explorer fails to validate User Mode Code
        Integrity (UMCI) policies. The vulnerability could allow
        an attacker to bypass Device Guard UMCI policies.
        (CVE-2018-8126)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows Kernel API enforces permissions. An
        attacker who successfully exploited the vulnerability
        could impersonate processes, interject cross-process
        communication, or interrupt system functionality.
        (CVE-2018-8134)
    
      - A denial of service vulnerability exists when .NET and
        .NET Core improperly process XML documents. An attacker
        who successfully exploited this vulnerability could
        cause a denial of service against a .NET application. A
        remote unauthenticated attacker could exploit this
        vulnerability by issuing specially crafted requests to a
        .NET (or .NET core) application. The update addresses
        the vulnerability by correcting how .NET and .NET Core
        applications handle XML document processing.
        (CVE-2018-0765)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Microsoft Edge. The vulnerability could corrupt memory
        in such a way that an attacker could execute arbitrary
        code in the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-0946,
        CVE-2018-0951, CVE-2018-0953, CVE-2018-8128,
        CVE-2018-8137)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0954, CVE-2018-1022)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows kernel image handles objects in
        memory. An attacker who successfully exploited the
        vulnerability could execute code with elevated
        permissions.  (CVE-2018-8170)");
      # https://support.microsoft.com/en-us/help/4103727/windows-10-update-kb4103727
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?41c43cb2");
      script_set_attribute(attribute:"solution", value:
      "Apply Cumulative Update KB4103727.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8136");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-05";
    kbs = make_list('4103727');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"10",
                       sp:0,
                       os_build:"16299",
                       rollup_date:"05_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4103727])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_MAY_4103730.NASL
    descriptionThe remote Windows host is missing security update 4103726 or cumulative update 4103730. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8897) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8167) - A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-1039) - An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data. (CVE-2018-8145) - A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. (CVE-2018-8136) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0954) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959) - A remote code execution vulnerability exists in Microsoft COM for Windows when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-0824) - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8174) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8127) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8124, CVE-2018-8164, CVE-2018-8166) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0955) - A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET (or .NET core) application. The update addresses the vulnerability by correcting how .NET and .NET Core applications handle XML document processing. (CVE-2018-0765)
    last seen2020-06-01
    modified2020-06-02
    plugin id109610
    published2018-05-08
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109610
    titleKB4103726: Windows Server 2012 May 2018 Security Update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(109610);
      script_version("1.10");
      script_cvs_date("Date: 2019/11/08");
    
      script_cve_id(
        "CVE-2018-0765",
        "CVE-2018-0824",
        "CVE-2018-0954",
        "CVE-2018-0955",
        "CVE-2018-0959",
        "CVE-2018-1039",
        "CVE-2018-8124",
        "CVE-2018-8127",
        "CVE-2018-8136",
        "CVE-2018-8145",
        "CVE-2018-8164",
        "CVE-2018-8166",
        "CVE-2018-8167",
        "CVE-2018-8174",
        "CVE-2018-8897"
      );
      script_xref(name:"MSKB", value:"4103730");
      script_xref(name:"MSKB", value:"4103726");
      script_xref(name:"MSFT", value:"MS18-4103730");
      script_xref(name:"MSFT", value:"MS18-4103726");
    
      script_name(english:"KB4103726: Windows Server 2012 May 2018 Security Update");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4103726
    or cumulative update 4103730. It is, therefore, affected by
    multiple vulnerabilities :
    
      - An elevation of privilege vulnerability exists when the
        Windows kernel fails to properly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could run arbitrary code in kernel mode.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights.  (CVE-2018-8897)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8167)
    
      - A security feature bypass vulnerability exists in .Net
        Framework which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-1039)
    
      - An information disclosure vulnerability exists when
        Chakra improperly discloses the contents of its memory,
        which could provide an attacker with information to
        further compromise the users computer or data.
        (CVE-2018-8145)
    
      - A remote code execution vulnerability exists in the way
        that Windows handles objects in memory. An attacker who
        successfully exploited the vulnerability could execute
        arbitrary code with elevated permissions on a target
        system.  (CVE-2018-8136)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0954)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system.  (CVE-2018-0959)
    
      - A remote code execution vulnerability exists in
        Microsoft COM for Windows when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-0824)
    
      - A remote code execution vulnerability exists in the way
        that the VBScript engine handles objects in memory. The
        vulnerability could corrupt memory in such a way that an
        attacker could execute arbitrary code in the context of
        the current user. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8174)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8127)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8124, CVE-2018-8164,
        CVE-2018-8166)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0955)
    
      - A denial of service vulnerability exists when .NET and
        .NET Core improperly process XML documents. An attacker
        who successfully exploited this vulnerability could
        cause a denial of service against a .NET application. A
        remote unauthenticated attacker could exploit this
        vulnerability by issuing specially crafted requests to a
        .NET (or .NET core) application. The update addresses
        the vulnerability by correcting how .NET and .NET Core
        applications handle XML document processing.
        (CVE-2018-0765)");
      # https://support.microsoft.com/en-us/help/4103730/windows-server-2012-update-kb4103730
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a47bd1fd");
      # https://support.microsoft.com/en-us/help/4103726/windows-server-2012-update-kb4103726
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?988e96ea");
      script_set_attribute(attribute:"solution", value:
    "Apply Security Only update KB4103726 or Cumulative Update KB4103730.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8136");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-05";
    kbs = make_list('4103730', '4103726');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win8:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    # Windows 8 EOL
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Windows 8" >< productname) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"6.2",
                       sp:0,
                       rollup_date:"05_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4103730, 4103726])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_MAY_4103731.NASL
    descriptionThe remote Windows host is missing security update 4103731. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-1039) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8178) - A remote code execution vulnerability exists in Microsoft COM for Windows when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-0824) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data. An attacker who successfully exploited these vulnerabilities could execute arbitrary code on a target operating system. To exploit these vulnerabilities, an attacker running inside a virtual machine could run a specially crafted application that could cause the Hyper-V host operating system to execute arbitrary code. The update addresses the vulnerabilities by correcting how Windows Hyper-V validates vSMB packet data. (CVE-2018-0961) - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-1025) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8167) - A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0958, CVE-2018-8129, CVE-2018-8132) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8127) - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8174) - A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy (SOP) restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploited the vulnerability could force the browser to send data that would otherwise be restricted. (CVE-2018-8112) - A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET (or .NET core) application. The update addresses the vulnerability by correcting how .NET and .NET Core applications handle XML document processing. (CVE-2018-0765) - An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8897) - An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data. (CVE-2018-8145) - A security feature bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0854) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8165) - A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. (CVE-2018-8136) - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0943, CVE-2018-8133) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8124, CVE-2018-8164, CVE-2018-8166) - A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies. The vulnerability could allow an attacker to bypass Device Guard UMCI policies. (CVE-2018-8126) - An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. An attacker who successfully exploited the vulnerability could impersonate processes, interject cross-process communication, or interrupt system functionality. (CVE-2018-8134) - A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8179) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-8128, CVE-2018-8137) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0954, CVE-2018-1022) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959) - An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. (CVE-2018-8170)
    last seen2020-06-01
    modified2020-06-02
    plugin id109611
    published2018-05-08
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109611
    titleKB4103731: Windows 10 Version 1703 May 2018 Security Update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(109611);
      script_version("1.11");
      script_cvs_date("Date: 2019/11/08");
    
      script_cve_id(
        "CVE-2018-0765",
        "CVE-2018-0824",
        "CVE-2018-0854",
        "CVE-2018-0943",
        "CVE-2018-0946",
        "CVE-2018-0951",
        "CVE-2018-0953",
        "CVE-2018-0954",
        "CVE-2018-0955",
        "CVE-2018-0958",
        "CVE-2018-0959",
        "CVE-2018-0961",
        "CVE-2018-1022",
        "CVE-2018-1025",
        "CVE-2018-1039",
        "CVE-2018-8112",
        "CVE-2018-8114",
        "CVE-2018-8122",
        "CVE-2018-8124",
        "CVE-2018-8126",
        "CVE-2018-8127",
        "CVE-2018-8128",
        "CVE-2018-8129",
        "CVE-2018-8132",
        "CVE-2018-8133",
        "CVE-2018-8134",
        "CVE-2018-8136",
        "CVE-2018-8137",
        "CVE-2018-8145",
        "CVE-2018-8164",
        "CVE-2018-8165",
        "CVE-2018-8166",
        "CVE-2018-8167",
        "CVE-2018-8170",
        "CVE-2018-8174",
        "CVE-2018-8178",
        "CVE-2018-8179",
        "CVE-2018-8897"
      );
      script_xref(name:"MSKB", value:"4103731");
      script_xref(name:"MSFT", value:"MS18-4103731");
    
      script_name(english:"KB4103731: Windows 10 Version 1703 May 2018 Security Update");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4103731.
    It is, therefore, affected by multiple vulnerabilities :
    
      - A security feature bypass vulnerability exists in .Net
        Framework which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-1039)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8178)
    
      - A remote code execution vulnerability exists in
        Microsoft COM for Windows when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-0824)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate vSMB packet data. An attacker who successfully
        exploited these vulnerabilities could execute arbitrary
        code on a target operating system. To exploit these
        vulnerabilities, an attacker running inside a virtual
        machine could run a specially crafted application that
        could cause the Hyper-V host operating system to execute
        arbitrary code. The update addresses the vulnerabilities
        by correcting how Windows Hyper-V validates vSMB packet
        data. (CVE-2018-0961)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could obtain information to further
        compromise the users system.  (CVE-2018-1025)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8167)
    
      - A security feature bypass vulnerability exists in
        Windows which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-0958,
        CVE-2018-8129, CVE-2018-8132)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8127)
    
      - A remote code execution vulnerability exists in the way
        that the VBScript engine handles objects in memory. The
        vulnerability could corrupt memory in such a way that an
        attacker could execute arbitrary code in the context of
        the current user. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8174)
    
      - A security feature bypass vulnerability exists when
        Microsoft Edge improperly handles requests of different
        origins. The vulnerability allows Microsoft Edge to
        bypass Same-Origin Policy (SOP) restrictions, and to
        allow requests that should otherwise be ignored. An
        attacker who successfully exploited the vulnerability
        could force the browser to send data that would
        otherwise be restricted.  (CVE-2018-8112)
    
      - A denial of service vulnerability exists when .NET and
        .NET Core improperly process XML documents. An attacker
        who successfully exploited this vulnerability could
        cause a denial of service against a .NET application. A
        remote unauthenticated attacker could exploit this
        vulnerability by issuing specially crafted requests to a
        .NET (or .NET core) application. The update addresses
        the vulnerability by correcting how .NET and .NET Core
        applications handle XML document processing.
        (CVE-2018-0765)
    
      - An elevation of privilege vulnerability exists when the
        Windows kernel fails to properly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could run arbitrary code in kernel mode.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights.  (CVE-2018-8897)
    
      - An information disclosure vulnerability exists when
        Chakra improperly discloses the contents of its memory,
        which could provide an attacker with information to
        further compromise the users computer or data.
        (CVE-2018-8145)
    
      - A security feature bypass vulnerability exists in
        Windows Scripting Host which could allow an attacker to
        bypass Device Guard. An attacker who successfully
        exploited this vulnerability could circumvent a User
        Mode Code Integrity (UMCI) policy on the machine.
        (CVE-2018-0854)
    
      - An elevation of privilege vulnerability exists when the
        DirectX Graphics Kernel (DXGKRNL) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8165)
    
      - A remote code execution vulnerability exists in the way
        that Windows handles objects in memory. An attacker who
        successfully exploited the vulnerability could execute
        arbitrary code with elevated permissions on a target
        system.  (CVE-2018-8136)
    
      - A remote code execution vulnerability exists in the way
        that the Chakra scripting engine handles objects in
        memory in Microsoft Edge. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2018-0943, CVE-2018-8133)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8124, CVE-2018-8164,
        CVE-2018-8166)
    
      - A security feature bypass vulnerability exists when
        Internet Explorer fails to validate User Mode Code
        Integrity (UMCI) policies. The vulnerability could allow
        an attacker to bypass Device Guard UMCI policies.
        (CVE-2018-8126)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows Kernel API enforces permissions. An
        attacker who successfully exploited the vulnerability
        could impersonate processes, interject cross-process
        communication, or interrupt system functionality.
        (CVE-2018-8134)
    
      - A remote code execution vulnerability exists when
        Microsoft Edge improperly accesses objects in memory.
        The vulnerability could corrupt memory in such a way
        that enables an attacker to execute arbitrary code in
        the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8179)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Microsoft Edge. The vulnerability could corrupt memory
        in such a way that an attacker could execute arbitrary
        code in the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-0946,
        CVE-2018-0951, CVE-2018-0953, CVE-2018-8128,
        CVE-2018-8137)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0954, CVE-2018-1022)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system.  (CVE-2018-0959)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows kernel image handles objects in
        memory. An attacker who successfully exploited the
        vulnerability could execute code with elevated
        permissions.  (CVE-2018-8170)");
      # https://support.microsoft.com/en-us/help/4103731/windows-10-update-kb4103731
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e6fc001a");
      script_set_attribute(attribute:"solution", value:
    "Apply Cumulative Update KB4103731.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8136");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-05";
    kbs = make_list('4103731');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"10",
                       sp:0,
                       os_build:"15063",
                       rollup_date:"05_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4103731])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_MAY_4103718.NASL
    descriptionThe remote Windows host is missing security update 4103712 or cumulative update 4103718. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8897) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8178) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8120, CVE-2018-8124, CVE-2018-8164, CVE-2018-8166) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0954, CVE-2018-1022) - A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-1039) - An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data. (CVE-2018-8145) - A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. (CVE-2018-8136) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8127) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8167) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959) - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-1025) - A remote code execution vulnerability exists in Microsoft COM for Windows when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-0824) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122) - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8174) - A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET (or .NET core) application. The update addresses the vulnerability by correcting how .NET and .NET Core applications handle XML document processing. (CVE-2018-0765)
    last seen2020-06-01
    modified2020-06-02
    plugin id109604
    published2018-05-08
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109604
    titleKB4103712: Windows 7 and Windows Server 2008 R2 May 2018 Security Update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(109604);
      script_version("1.10");
      script_cvs_date("Date: 2019/11/08");
    
      script_cve_id(
        "CVE-2018-0765",
        "CVE-2018-0824",
        "CVE-2018-0954",
        "CVE-2018-0955",
        "CVE-2018-0959",
        "CVE-2018-1022",
        "CVE-2018-1025",
        "CVE-2018-1039",
        "CVE-2018-8114",
        "CVE-2018-8120",
        "CVE-2018-8122",
        "CVE-2018-8124",
        "CVE-2018-8127",
        "CVE-2018-8136",
        "CVE-2018-8145",
        "CVE-2018-8164",
        "CVE-2018-8166",
        "CVE-2018-8167",
        "CVE-2018-8174",
        "CVE-2018-8178",
        "CVE-2018-8897"
      );
      script_xref(name:"MSKB", value:"4103718");
      script_xref(name:"MSKB", value:"4103712");
      script_xref(name:"MSFT", value:"MS18-4103718");
      script_xref(name:"MSFT", value:"MS18-4103712");
    
      script_name(english:"KB4103712: Windows 7 and Windows Server 2008 R2 May 2018 Security Update");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4103712
    or cumulative update 4103718. It is, therefore, affected by
    multiple vulnerabilities :
    
      - An elevation of privilege vulnerability exists when the
        Windows kernel fails to properly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could run arbitrary code in kernel mode.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights.  (CVE-2018-8897)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8178)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8120, CVE-2018-8124,
        CVE-2018-8164, CVE-2018-8166)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0954, CVE-2018-1022)
    
      - A security feature bypass vulnerability exists in .Net
        Framework which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-1039)
    
      - An information disclosure vulnerability exists when
        Chakra improperly discloses the contents of its memory,
        which could provide an attacker with information to
        further compromise the users computer or data.
        (CVE-2018-8145)
    
      - A remote code execution vulnerability exists in the way
        that Windows handles objects in memory. An attacker who
        successfully exploited the vulnerability could execute
        arbitrary code with elevated permissions on a target
        system.  (CVE-2018-8136)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8127)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8167)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system.  (CVE-2018-0959)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could obtain information to further
        compromise the users system.  (CVE-2018-1025)
    
      - A remote code execution vulnerability exists in
        Microsoft COM for Windows when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-0824)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)
    
      - A remote code execution vulnerability exists in the way
        that the VBScript engine handles objects in memory. The
        vulnerability could corrupt memory in such a way that an
        attacker could execute arbitrary code in the context of
        the current user. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8174)
    
      - A denial of service vulnerability exists when .NET and
        .NET Core improperly process XML documents. An attacker
        who successfully exploited this vulnerability could
        cause a denial of service against a .NET application. A
        remote unauthenticated attacker could exploit this
        vulnerability by issuing specially crafted requests to a
        .NET (or .NET core) application. The update addresses
        the vulnerability by correcting how .NET and .NET Core
        applications handle XML document processing.
        (CVE-2018-0765)");
      # https://support.microsoft.com/en-us/help/4103718/windows-7-update-kb4103718
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9cd8d3d4");
      # https://support.microsoft.com/en-us/help/4103712/windows-7-update-kb4103712
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0cbb798a");
      script_set_attribute(attribute:"solution", value:
    "Apply Security Only update KB4103712 or Cumulative Update KB4103718.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8136");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-05";
    kbs = make_list('4103718', '4103712');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win7:'1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"6.1",
                       sp:1,
                       rollup_date:"05_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4103718, 4103712])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_MAY_WIN2008.NASL
    descriptionThe remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the Credential Security Support Provider protocol (CredSSP). An attacker who successfully exploits this vulnerability could relay user credentials and use them to execute code on the target host. (CVE-2018-0886) - An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8897) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8167) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8120, CVE-2018-8124, CVE-2018-8164, CVE-2018-8166) - A remote code execution vulnerability exists in &quot;Microsoft COM for Windows&quot; when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-0824) - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8174) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959)
    last seen2020-06-01
    modified2020-06-02
    plugin id109651
    published2018-05-09
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109651
    titleSecurity Updates for Windows Server 2008 (May 2018)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(109651);
      script_version("1.13");
      script_cvs_date("Date: 2019/11/08");
    
      script_cve_id(
        "CVE-2018-0824",
        "CVE-2018-0886",
        "CVE-2018-0959",
        "CVE-2018-8120",
        "CVE-2018-8124",
        "CVE-2018-8164",
        "CVE-2018-8166",
        "CVE-2018-8167",
        "CVE-2018-8174",
        "CVE-2018-8897"
      );
      script_bugtraq_id(
        103998,
        104030,
        104031,
        104033,
        104034,
        104037,
        104063,
        104071
      );
      script_xref(name:"MSKB", value:"4056564");
      script_xref(name:"MSKB", value:"4094079");
      script_xref(name:"MSKB", value:"4101477");
      script_xref(name:"MSKB", value:"4130944");
      script_xref(name:"MSKB", value:"4131188");
      script_xref(name:"MSKB", value:"4134651");
      script_xref(name:"MSFT", value:"MS18-4056564");
      script_xref(name:"MSFT", value:"MS18-4094079");
      script_xref(name:"MSFT", value:"MS18-4101477");
      script_xref(name:"MSFT", value:"MS18-4130944");
      script_xref(name:"MSFT", value:"MS18-4131188");
      script_xref(name:"MSFT", value:"MS18-4134651");
    
      script_name(english:"Security Updates for Windows Server 2008 (May 2018)");
      script_summary(english:"Checks for Microsoft security updates.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security updates. It is,
    therefore, affected by multiple vulnerabilities :
    
      - A remote code execution vulnerability exists in the Credential
        Security Support Provider protocol (CredSSP). An attacker who
        successfully exploits this vulnerability could relay user
        credentials and use them to execute code on the target host.
        (CVE-2018-0886)
    
      - An elevation of privilege vulnerability exists when the
        Windows kernel fails to properly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could run arbitrary code in kernel mode.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights.  (CVE-2018-8897)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8167)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8120, CVE-2018-8124,
        CVE-2018-8164, CVE-2018-8166)
    
      - A remote code execution vulnerability exists in
        &quot;Microsoft COM for Windows&quot; when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-0824)
    
      - A remote code execution vulnerability exists in the way
        that the VBScript engine handles objects in memory. The
        vulnerability could corrupt memory in such a way that an
        attacker could execute arbitrary code in the context of
        the current user. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8174)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system.  (CVE-2018-0959)");
      # https://support.microsoft.com/en-us/help/4056564/security-update-for-vulnerabilities-in-windows-server-2008
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b5f5c446");
      # https://support.microsoft.com/en-us/help/4094079/security-update-for-vulnerabilities-in-windows-server-2008
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?772e96fe");
      # https://support.microsoft.com/en-us/help/4134651/description-of-the-security-update-for-vulnerabilities-in-windows
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5ebb568d");
      # https://support.microsoft.com/en-us/help/4131188/win32k-elevation-of-privilege-vulnerability
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3f9bcdfa");
      # https://support.microsoft.com/en-us/help/4130944/windows-common-log-file-system-driver-vulnerability
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?28ae25e4");
      # https://support.microsoft.com/en-us/help/4101477/microsoft-com-for-windows-remote-code-execution-vulnerability
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?90a897a3");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released security updates for Windows Server 2008.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8174");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", "wmi_enum_server_features.nbin");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = 'MS18-05';
    
    kbs = make_list(
      "4056564",
      "4094079",
      "4101477",
      "4130944",
      "4131188",
      "4134651"
    );
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    # KBs only apply to Windows 2008
    if (hotfix_check_sp_range(vista:'2') <= 0)
      audit(AUDIT_OS_SP_NOT_VULN);
    
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Vista" >< productname) audit(AUDIT_OS_SP_NOT_VULN);
    
    systemroot = hotfix_get_systemroot();
    if (!systemroot) audit(AUDIT_PATH_NOT_DETERMINED, 'system root');
    
    arch = get_kb_item_or_exit('SMB/ARCH', exit_code:1);
    
    port   = kb_smb_transport();
    login  = kb_smb_login();
    pass   = kb_smb_password();
    domain = kb_smb_domain();
    
    if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');
    
    winsxs = ereg_replace(pattern:'^[A-Za-z]:(.*)', replace:"\1\WinSxS", string:systemroot);
    winsxs_share = hotfix_path2share(path:systemroot);
    
    rc = NetUseAdd(login:login, password:pass, domain:domain, share:winsxs_share);
    if (rc != 1)
    {
      NetUseDel();
      audit(AUDIT_SHARE_FAIL, winsxs_share);
    }
    
    the_session = make_array(
      'login',    login,
      'password', pass,
      'domain',   domain,
      'share',    winsxs_share
    );
    
    vuln = 0;
    
    # KB4056564
    files = list_dir(basedir:winsxs, level:0, dir_pat:"security-schannel_31bf3856ad364e35", file_pat:"^schannel\.dll$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('6.0.6002.24383'),
                                max_versions:make_list('6.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4056564", session:the_session);
    
    
    # KB4094079 (hyper-v ; 64bit only)
    files = list_dir(basedir:winsxs, level:0, dir_pat:"hyper-v-storage_31bf3856ad364e35", file_pat:"^synthstor\.dll$", max_recurse:1);
    if (
      arch == "x64" &&
      (get_kb_item('WMI/server_feature/20') || report_paranoia == 2 ) &&
      hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('6.0.6002.24362'),
                                max_versions:make_list('6.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4094079", session:the_session)
    )
    {
      vuln++;
    }
    
    # KB4101477
    files = list_dir(basedir:winsxs, level:0, dir_pat:"catsrvut-comsvcs_31bf3856ad364e35", file_pat:"^catsrvut\.dll$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('2001.12.6932.24363'),
                                max_versions:make_list('2001.12.6932.99999'),
                                bulletin:bulletin,
                                kb:"4101477", session:the_session);
    
    
    # KB4130944
    files = list_dir(basedir:winsxs, level:0, dir_pat:"commonlog_31bf3856ad364e35", file_pat:"^clfs\.sys$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('6.0.6002.24361'),
                                max_versions:make_list('6.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4130944", session:the_session);
    
    # KB4131188
    files = list_dir(basedir:winsxs, level:0, dir_pat:"win32k_31bf3856ad364e35", file_pat:"^win32k\.sys$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('6.0.6002.24363'),
                                max_versions:make_list('6.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4131188", session:the_session);
    
    # KB4134651
    files = list_dir(basedir:winsxs, level:0, dir_pat:"ntdll_31bf3856ad364e35", file_pat:"^ntdll\.dll$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('6.0.6002.24367'),
                                max_versions:make_list('6.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4134651", session:the_session);
    
    if (vuln > 0)
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, 'affected');
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_MAY_4103716.NASL
    descriptionThe remote Windows host is missing security update 4103716. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-1039) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8178) - A remote code execution vulnerability exists in Microsoft COM for Windows when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-0824) - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-1025) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122) - An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8167) - A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0958, CVE-2018-8129, CVE-2018-8132) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8127) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0953, CVE-2018-8137) - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8174) - A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy (SOP) restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploited the vulnerability could force the browser to send data that would otherwise be restricted. (CVE-2018-8112) - A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET (or .NET core) application. The update addresses the vulnerability by correcting how .NET and .NET Core applications handle XML document processing. (CVE-2018-0765) - An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8897) - An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data. (CVE-2018-8145) - A security feature bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine. (CVE-2018-0854) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8165) - A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. (CVE-2018-8136) - A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8124, CVE-2018-8164, CVE-2018-8166) - A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies. The vulnerability could allow an attacker to bypass Device Guard UMCI policies. (CVE-2018-8126) - An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. An attacker who successfully exploited the vulnerability could impersonate processes, interject cross-process communication, or interrupt system functionality. (CVE-2018-8134) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0954, CVE-2018-1022) - A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8179) - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-0943, CVE-2018-8133)
    last seen2020-06-01
    modified2020-06-02
    plugin id109603
    published2018-05-08
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109603
    titleKB4103716: Windows 10 May 2018 Security Update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(109603);
      script_version("1.11");
      script_cvs_date("Date: 2019/11/08");
    
      script_cve_id(
        "CVE-2018-0765",
        "CVE-2018-0824",
        "CVE-2018-0854",
        "CVE-2018-0943",
        "CVE-2018-0953",
        "CVE-2018-0954",
        "CVE-2018-0955",
        "CVE-2018-0958",
        "CVE-2018-0959",
        "CVE-2018-1022",
        "CVE-2018-1025",
        "CVE-2018-1039",
        "CVE-2018-8112",
        "CVE-2018-8114",
        "CVE-2018-8122",
        "CVE-2018-8124",
        "CVE-2018-8126",
        "CVE-2018-8127",
        "CVE-2018-8129",
        "CVE-2018-8132",
        "CVE-2018-8133",
        "CVE-2018-8134",
        "CVE-2018-8136",
        "CVE-2018-8137",
        "CVE-2018-8145",
        "CVE-2018-8164",
        "CVE-2018-8165",
        "CVE-2018-8166",
        "CVE-2018-8167",
        "CVE-2018-8174",
        "CVE-2018-8178",
        "CVE-2018-8179",
        "CVE-2018-8897"
      );
      script_xref(name:"MSKB", value:"4103716");
      script_xref(name:"MSFT", value:"MS18-4103716");
    
      script_name(english:"KB4103716: Windows 10 May 2018 Security Update");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4103716.
    It is, therefore, affected by multiple vulnerabilities :
    
      - A security feature bypass vulnerability exists in .Net
        Framework which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-1039)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8178)
    
      - A remote code execution vulnerability exists in
        Microsoft COM for Windows when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-0824)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could obtain information to further
        compromise the users system.  (CVE-2018-1025)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)
    
      - An elevation of privilege vulnerability exists when the
        Windows Common Log File System (CLFS) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8167)
    
      - A security feature bypass vulnerability exists in
        Windows which could allow an attacker to bypass Device
        Guard. An attacker who successfully exploited this
        vulnerability could circumvent a User Mode Code
        Integrity (UMCI) policy on the machine.  (CVE-2018-0958,
        CVE-2018-8129, CVE-2018-8132)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8127)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Microsoft Edge. The vulnerability could corrupt memory
        in such a way that an attacker could execute arbitrary
        code in the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-0953,
        CVE-2018-8137)
    
      - A remote code execution vulnerability exists in the way
        that the VBScript engine handles objects in memory. The
        vulnerability could corrupt memory in such a way that an
        attacker could execute arbitrary code in the context of
        the current user. An attacker who successfully exploited
        the vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8174)
    
      - A security feature bypass vulnerability exists when
        Microsoft Edge improperly handles requests of different
        origins. The vulnerability allows Microsoft Edge to
        bypass Same-Origin Policy (SOP) restrictions, and to
        allow requests that should otherwise be ignored. An
        attacker who successfully exploited the vulnerability
        could force the browser to send data that would
        otherwise be restricted.  (CVE-2018-8112)
    
      - A denial of service vulnerability exists when .NET and
        .NET Core improperly process XML documents. An attacker
        who successfully exploited this vulnerability could
        cause a denial of service against a .NET application. A
        remote unauthenticated attacker could exploit this
        vulnerability by issuing specially crafted requests to a
        .NET (or .NET core) application. The update addresses
        the vulnerability by correcting how .NET and .NET Core
        applications handle XML document processing.
        (CVE-2018-0765)
    
      - An elevation of privilege vulnerability exists when the
        Windows kernel fails to properly handle objects in
        memory. An attacker who successfully exploited this
        vulnerability could run arbitrary code in kernel mode.
        An attacker could then install programs; view, change,
        or delete data; or create new accounts with full user
        rights.  (CVE-2018-8897)
    
      - An information disclosure vulnerability exists when
        Chakra improperly discloses the contents of its memory,
        which could provide an attacker with information to
        further compromise the users computer or data.
        (CVE-2018-8145)
    
      - A security feature bypass vulnerability exists in
        Windows Scripting Host which could allow an attacker to
        bypass Device Guard. An attacker who successfully
        exploited this vulnerability could circumvent a User
        Mode Code Integrity (UMCI) policy on the machine.
        (CVE-2018-0854)
    
      - An elevation of privilege vulnerability exists when the
        DirectX Graphics Kernel (DXGKRNL) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8165)
    
      - A remote code execution vulnerability exists in the way
        that Windows handles objects in memory. An attacker who
        successfully exploited the vulnerability could execute
        arbitrary code with elevated permissions on a target
        system.  (CVE-2018-8136)
    
      - A remote code execution vulnerability exists when
        Windows Hyper-V on a host server fails to properly
        validate input from an authenticated user on a guest
        operating system.  (CVE-2018-0959)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8124, CVE-2018-8164,
        CVE-2018-8166)
    
      - A security feature bypass vulnerability exists when
        Internet Explorer fails to validate User Mode Code
        Integrity (UMCI) policies. The vulnerability could allow
        an attacker to bypass Device Guard UMCI policies.
        (CVE-2018-8126)
    
      - An elevation of privilege vulnerability exists in the
        way that the Windows Kernel API enforces permissions. An
        attacker who successfully exploited the vulnerability
        could impersonate processes, interject cross-process
        communication, or interrupt system functionality.
        (CVE-2018-8134)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-0954, CVE-2018-1022)
    
      - A remote code execution vulnerability exists when
        Microsoft Edge improperly accesses objects in memory.
        The vulnerability could corrupt memory in such a way
        that enables an attacker to execute arbitrary code in
        the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8179)
    
      - A remote code execution vulnerability exists in the way
        that the Chakra scripting engine handles objects in
        memory in Microsoft Edge. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2018-0943, CVE-2018-8133)");
      # https://support.microsoft.com/en-us/help/4103716/windows-10-update-kb4103716
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fb504ab5");
      script_set_attribute(attribute:"solution", value:
    "Apply Cumulative Update KB4103716.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8136");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-05";
    kbs = make_list('4103716');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"10",
                       sp:0,
                       os_build:"10240",
                       rollup_date:"05_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4103716])
    )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/147877/msie11vbscript-exec.txt
idPACKETSTORM:147877
last seen2018-05-25
published2018-05-24
reportersmgorelik
sourcehttps://packetstormsecurity.com/files/147877/Microsoft-Internet-Explorer-11-Vbscript-Code-Execution.html
titleMicrosoft Internet Explorer 11 Vbscript Code Execution

The Hacker News

idTHN:8ECA2639341E23BD24E0C06DE0556482
last seen2018-05-09
modified2018-05-09
published2018-05-09
reporterSwati Khandelwal
sourcehttps://thehackernews.com/2018/05/microsoft-patch-tuesday.html
titleMicrosoft Patches Two Zero-Day Flaws Under Active Attack