Vulnerabilities > CVE-2018-8345 - Code Injection vulnerability in Microsoft products

047910
CVSS 7.6 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
high complexity
microsoft
CWE-94
nessus

Summary

A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LNK Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8346.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_AUG_4343887.NASL
    descriptionThe remote Windows host is missing security update 4343887. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8341, CVE-2018-8348) - A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8344) - An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. (CVE-2018-8343) - A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-8349) - A security feature bypass vulnerability exists when Microsoft Edge improperly handles redirect requests. The vulnerability allows Microsoft Edge to bypass Cross- Origin Resource Sharing (CORS) redirect restrictions, and to follow redirect requests that should otherwise be ignored. An attacker who successfully exploited the vulnerability could force the browser to send data that would otherwise be restricted to a destination website of the attacker
    last seen2020-06-01
    modified2020-06-02
    plugin id111685
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111685
    titleKB4343887: Windows 10 Version 1607 and Windows Server 2016 August 2018 Security Update (Foreshadow)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(111685);
      script_version("1.18");
      script_cvs_date("Date: 2019/12/18");
    
      script_cve_id(
        "CVE-2018-3615",
        "CVE-2018-3620",
        "CVE-2018-3646",
        "CVE-2018-0952",
        "CVE-2018-8200",
        "CVE-2018-8204",
        "CVE-2018-8253",
        "CVE-2018-8266",
        "CVE-2018-8316",
        "CVE-2018-8339",
        "CVE-2018-8340",
        "CVE-2018-8341",
        "CVE-2018-8343",
        "CVE-2018-8344",
        "CVE-2018-8345",
        "CVE-2018-8347",
        "CVE-2018-8348",
        "CVE-2018-8349",
        "CVE-2018-8351",
        "CVE-2018-8353",
        "CVE-2018-8355",
        "CVE-2018-8357",
        "CVE-2018-8358",
        "CVE-2018-8360",
        "CVE-2018-8370",
        "CVE-2018-8371",
        "CVE-2018-8372",
        "CVE-2018-8373",
        "CVE-2018-8381",
        "CVE-2018-8385",
        "CVE-2018-8388",
        "CVE-2018-8389",
        "CVE-2018-8394",
        "CVE-2018-8398",
        "CVE-2018-8401",
        "CVE-2018-8403",
        "CVE-2018-8404",
        "CVE-2018-8405",
        "CVE-2018-8406"
      );
      script_bugtraq_id(
        104977,
        104978,
        104980,
        104982,
        104983,
        104984,
        104986,
        104987,
        104988,
        104992,
        104995,
        104999,
        105001,
        105006,
        105007,
        105008,
        105009,
        105011,
        105012,
        105017,
        105027,
        105029,
        105030,
        105048
      );
      script_xref(name:"MSKB", value:"4343887");
      script_xref(name:"MSFT", value:"MS18-4343887");
    
      script_name(english:"KB4343887: Windows 10 Version 1607 and Windows Server 2016 August 2018 Security Update (Foreshadow)");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4343887.
    It is, therefore, affected by multiple vulnerabilities :
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8341, CVE-2018-8348)
    
      - A remote code execution vulnerability exists when the
        Windows font library improperly handles specially
        crafted embedded fonts. An attacker who successfully
        exploited the vulnerability could take control of the
        affected system. An attacker could then install
        programs; view, change, or delete data; or create new
        accounts with full user rights.  (CVE-2018-8344)
    
      - An elevation of privilege vulnerability exists in the
        Network Driver Interface Specification (NDIS) when
        ndis.sys fails to check the length of a buffer prior to
        copying memory to it.  (CVE-2018-8343)
    
      - A remote code execution vulnerability exists in
        "Microsoft COM for Windows" when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-8349)
    
      - A security feature bypass vulnerability exists when
        Microsoft Edge improperly handles redirect requests. The
        vulnerability allows Microsoft Edge to bypass Cross-
        Origin Resource Sharing (CORS) redirect restrictions,
        and to follow redirect requests that should otherwise be
        ignored. An attacker who successfully exploited the
        vulnerability could force the browser to send data that
        would otherwise be restricted to a destination website
        of the attacker's choice.  (CVE-2018-8358)
    
      - A security feature bypass vulnerability exists in Device
        Guard that could allow an attacker to inject malicious
        code into a Windows PowerShell session. An attacker who
        successfully exploited this vulnerability could inject
        code into a trusted PowerShell process to bypass the
        Device Guard Code Integrity policy on the local machine.
        (CVE-2018-8200, CVE-2018-8204)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385)
    
      - An elevation of privilege vulnerability exists in
        Microsoft Windows when the Windows kernel fails to
        properly handle parsing of certain symbolic links. An
        attacker who successfully exploited this vulnerability
        could potentially access privileged registry keys and
        thereby elevate permissions. An attacker could then
        install programs; view, change, or delete data; or
        create new accounts with full user rights.
        (CVE-2018-8347)
    
      - A remote code execution vulnerability exists in
        Microsoft Windows that could allow remote code execution
        if a .LNK file is processed. An attacker who
        successfully exploited this vulnerability could gain the
        same user rights as the local user.  (CVE-2018-8345)
    
      - A information disclosure vulnerability exists when
        WebAudio Library improperly handles audio requests. An
        attacker who has successfully exploited this
        vulnerability might be able to read privileged data
        across trust boundaries. In browsing scenarios, an
        attacker could convince a user to visit a malicious site
        and leverage the vulnerability to obtain privileged
        information from the browser process, such as sensitive
        data from other opened tabs. An attacker could also
        inject malicious code into advertising networks used by
        trusted sites or embed malicious code on a compromised,
        but trusted, site. The update addresses the
        vulnerability by correcting how the WebAudio Library
        handles audio requests. (CVE-2018-8370)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8404)
    
      - An elevation of privilege vulnerability exists in the
        Windows Installer when the Windows Installer fails to
        properly sanitize input leading to an insecure library
        loading behavior. A locally authenticated attacker could
        run arbitrary code with elevated system privileges. An
        attacker could then install programs; view, change, or
        delete data; or create new accounts with full user
        rights. The security update addresses the vulnerability
        by correcting the input sanitization error to preclude
        unintended elevation. (CVE-2018-8339)
    
      - A security feature bypass vulnerability exists when
        Active Directory Federation Services (AD FS) improperly
        handles multi-factor authentication requests.
        (CVE-2018-8340)
    
      - A remote code execution vulnerability exists in the way
        that the Chakra scripting engine handles objects in
        memory in Microsoft Edge. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8266, CVE-2018-8381)
    
      - An elevation of privilege vulnerability exists when
        Microsoft Cortana allows arbitrary website browsing on
        the lockscreen. An attacker who successfully exploited
        the vulnerability could steal browser stored passwords
        or log on to websites as another user.  (CVE-2018-8253)
    
      - A remote code execution vulnerability exists when
        Internet Explorer improperly validates hyperlinks before
        loading executable libraries. An attacker who
        successfully exploited this vulnerability could take
        control of an affected system. An attacker could then
        install programs; view, change, or delete data; or
        create new accounts with full user rights.
        (CVE-2018-8316)
    
      - An information disclosure vulnerability exists when the
        Windows GDI component improperly discloses the contents
        of its memory. An attacker who successfully exploited
        the vulnerability could obtain information to further
        compromise the users system. There are multiple ways an
        attacker could exploit the vulnerability, such as by
        convincing a user to open a specially crafted document,
        or by convincing a user to visit an untrusted webpage.
        The security update addresses the vulnerability by
        correcting how the Windows GDI component handles objects
        in memory. (CVE-2018-8394, CVE-2018-8398)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8403)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly allow cross-frame
        interaction. An attacker who successfully exploited this
        vulnerability could allow an attacker to obtain browser
        frame or window state from a different domain. For an
        attack to be successful, an attacker must persuade a
        user to open a malicious website from a secure website.
        This update addresses the vulnerability by denying
        permission to read the state of the object model, to
        which frames or windows on different domains should not
        have access. (CVE-2018-8351)
    
      - An elevation of privilege vulnerability exists in
        Microsoft browsers allowing sandbox escape. An attacker
        who successfully exploited the vulnerability could use
        the sandbox escape to elevate privileges on an affected
        system. This vulnerability by itself does not allow
        arbitrary code execution; however, it could allow
        arbitrary code to be run if the attacker uses it in
        combination with another vulnerability (such as a remote
        code execution vulnerability or another elevation of
        privilege vulnerability) that is capable of leveraging
        the elevated privileges when code execution is
        attempted. (CVE-2018-8357)
    
      - An Elevation of Privilege vulnerability exists when
        Diagnostics Hub Standard Collector allows file creation
        in arbitrary locations.  (CVE-2018-0952)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373,
        CVE-2018-8389)
    
      - An elevation of privilege vulnerability exists when the
        DirectX Graphics Kernel (DXGKRNL) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8401, CVE-2018-8405,
        CVE-2018-8406)
    
      - An information disclosure vulnerability exists in
        Microsoft .NET Framework that could allow an attacker to
        access information in multi-tenant environments. The
        vulnerability is caused when .NET Framework is used in
        high-load/high-density network connections where content
        from one stream can blend into another stream.
        (CVE-2018-8360)
    
      - A spoofing vulnerability exists when Microsoft Edge
        improperly handles specific HTML content. An attacker
        who successfully exploited this vulnerability could
        trick a user into believing that the user was on a
        legitimate website. The specially crafted website could
        either spoof content or serve as a pivot to chain an
        attack with other vulnerabilities in web services.
        (CVE-2018-8388)");
      # https://support.microsoft.com/en-us/help/4343887/windows-10-update-kb4343887
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?93e63484");
      # https://support.microsoft.com/en-us/help/4072698/windows-server-speculative-execution-side-channel-vulnerabilities-prot
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8902cebb");
      script_set_attribute(attribute:"solution", value:
      "Apply Cumulative Update KB4343887 as well as refer to the KB article for additional information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8344");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", 'microsoft_windows_env_vars.nasl');
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    include("smb_reg_query.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-08";
    kbs = make_list('4343887');
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"10",
                       sp:0,
                       os_build:"14393",
                       rollup_date:"08_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4343887])
      )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_AUG_4343892.NASL
    descriptionThe remote Windows host is missing security update 4343892. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8403) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8341, CVE-2018-8348) - A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8344) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8404) - A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8316) - A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session. An attacker who successfully exploited this vulnerability could inject code into a trusted PowerShell process to bypass the Device Guard Code Integrity policy on the local machine. (CVE-2018-8200, CVE-2018-8204) - An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations. (CVE-2018-0952) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385) - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8266, CVE-2018-8381) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373, CVE-2018-8389) - A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. (CVE-2018-8345) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8401, CVE-2018-8405, CVE-2018-8406) - A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests. An attacker who has successfully exploited this vulnerability might be able to read privileged data across trust boundaries. In browsing scenarios, an attacker could convince a user to visit a malicious site and leverage the vulnerability to obtain privileged information from the browser process, such as sensitive data from other opened tabs. An attacker could also inject malicious code into advertising networks used by trusted sites or embed malicious code on a compromised, but trusted, site. The update addresses the vulnerability by correcting how the WebAudio Library handles audio requests. (CVE-2018-8370) - An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. (CVE-2018-8343) - An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage. The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory. (CVE-2018-8394, CVE-2018-8398) - A remote code execution vulnerability exists in &quot;Microsoft COM for Windows&quot; when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-8349) - An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. (CVE-2018-8339) - An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments. The vulnerability is caused when .NET Framework is used in high-load/high-density network connections where content from one stream can blend into another stream. (CVE-2018-8360) - An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction. An attacker who successfully exploited this vulnerability could allow an attacker to obtain browser frame or window state from a different domain. For an attack to be successful, an attacker must persuade a user to open a malicious website from a secure website. This update addresses the vulnerability by denying permission to read the state of the object model, to which frames or windows on different domains should not have access. (CVE-2018-8351) - An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system. This vulnerability by itself does not allow arbitrary code execution; however, it could allow arbitrary code to be run if the attacker uses it in combination with another vulnerability (such as a remote code execution vulnerability or another elevation of privilege vulnerability) that is capable of leveraging the elevated privileges when code execution is attempted. (CVE-2018-8357)
    last seen2020-06-01
    modified2020-06-02
    plugin id111686
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111686
    titleKB4343892: Windows 10 August 2018 Security Update (Foreshadow)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(111686);
      script_version("1.15");
      script_cvs_date("Date: 2019/12/18");
    
      script_cve_id(
        "CVE-2018-3615",
        "CVE-2018-3620",
        "CVE-2018-3646",
        "CVE-2018-0952",
        "CVE-2018-8200",
        "CVE-2018-8204",
        "CVE-2018-8266",
        "CVE-2018-8316",
        "CVE-2018-8339",
        "CVE-2018-8341",
        "CVE-2018-8343",
        "CVE-2018-8344",
        "CVE-2018-8345",
        "CVE-2018-8348",
        "CVE-2018-8349",
        "CVE-2018-8351",
        "CVE-2018-8353",
        "CVE-2018-8355",
        "CVE-2018-8357",
        "CVE-2018-8360",
        "CVE-2018-8370",
        "CVE-2018-8371",
        "CVE-2018-8372",
        "CVE-2018-8373",
        "CVE-2018-8381",
        "CVE-2018-8385",
        "CVE-2018-8389",
        "CVE-2018-8394",
        "CVE-2018-8398",
        "CVE-2018-8401",
        "CVE-2018-8403",
        "CVE-2018-8404",
        "CVE-2018-8405",
        "CVE-2018-8406"
      );
      script_bugtraq_id(
        104977,
        104978,
        104980,
        104982,
        104983,
        104984,
        104986,
        104987,
        104992,
        104995,
        104999,
        105001,
        105006,
        105007,
        105008,
        105011,
        105012,
        105027,
        105030,
        105048
      );
      script_xref(name:"MSKB", value:"4343892");
      script_xref(name:"MSFT", value:"MS18-4343892");
    
      script_name(english:"KB4343892: Windows 10 August 2018 Security Update (Foreshadow)");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4343892.
    It is, therefore, affected by multiple vulnerabilities :
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8403)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8341, CVE-2018-8348)
    
      - A remote code execution vulnerability exists when the
        Windows font library improperly handles specially
        crafted embedded fonts. An attacker who successfully
        exploited the vulnerability could take control of the
        affected system. An attacker could then install
        programs; view, change, or delete data; or create new
        accounts with full user rights.  (CVE-2018-8344)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8404)
    
      - A remote code execution vulnerability exists when
        Internet Explorer improperly validates hyperlinks before
        loading executable libraries. An attacker who
        successfully exploited this vulnerability could take
        control of an affected system. An attacker could then
        install programs; view, change, or delete data; or
        create new accounts with full user rights.
        (CVE-2018-8316)
    
      - A security feature bypass vulnerability exists in Device
        Guard that could allow an attacker to inject malicious
        code into a Windows PowerShell session. An attacker who
        successfully exploited this vulnerability could inject
        code into a trusted PowerShell process to bypass the
        Device Guard Code Integrity policy on the local machine.
        (CVE-2018-8200, CVE-2018-8204)
    
      - An Elevation of Privilege vulnerability exists when
        Diagnostics Hub Standard Collector allows file creation
        in arbitrary locations.  (CVE-2018-0952)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385)
    
      - A remote code execution vulnerability exists in the way
        that the Chakra scripting engine handles objects in
        memory in Microsoft Edge. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8266, CVE-2018-8381)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373,
        CVE-2018-8389)
    
      - A remote code execution vulnerability exists in
        Microsoft Windows that could allow remote code execution
        if a .LNK file is processed. An attacker who
        successfully exploited this vulnerability could gain the
        same user rights as the local user.  (CVE-2018-8345)
    
      - An elevation of privilege vulnerability exists when the
        DirectX Graphics Kernel (DXGKRNL) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8401, CVE-2018-8405,
        CVE-2018-8406)
    
      - A information disclosure vulnerability exists when
        WebAudio Library improperly handles audio requests. An
        attacker who has successfully exploited this
        vulnerability might be able to read privileged data
        across trust boundaries. In browsing scenarios, an
        attacker could convince a user to visit a malicious site
        and leverage the vulnerability to obtain privileged
        information from the browser process, such as sensitive
        data from other opened tabs. An attacker could also
        inject malicious code into advertising networks used by
        trusted sites or embed malicious code on a compromised,
        but trusted, site. The update addresses the
        vulnerability by correcting how the WebAudio Library
        handles audio requests. (CVE-2018-8370)
    
      - An elevation of privilege vulnerability exists in the
        Network Driver Interface Specification (NDIS) when
        ndis.sys fails to check the length of a buffer prior to
        copying memory to it.  (CVE-2018-8343)
    
      - An information disclosure vulnerability exists when the
        Windows GDI component improperly discloses the contents
        of its memory. An attacker who successfully exploited
        the vulnerability could obtain information to further
        compromise the users system. There are multiple ways an
        attacker could exploit the vulnerability, such as by
        convincing a user to open a specially crafted document,
        or by convincing a user to visit an untrusted webpage.
        The security update addresses the vulnerability by
        correcting how the Windows GDI component handles objects
        in memory. (CVE-2018-8394, CVE-2018-8398)
    
      - A remote code execution vulnerability exists in
        &quot;Microsoft COM for Windows&quot; when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-8349)
    
      - An elevation of privilege vulnerability exists in the
        Windows Installer when the Windows Installer fails to
        properly sanitize input leading to an insecure library
        loading behavior. A locally authenticated attacker could
        run arbitrary code with elevated system privileges. An
        attacker could then install programs; view, change, or
        delete data; or create new accounts with full user
        rights. The security update addresses the vulnerability
        by correcting the input sanitization error to preclude
        unintended elevation. (CVE-2018-8339)
    
      - An information disclosure vulnerability exists in
        Microsoft .NET Framework that could allow an attacker to
        access information in multi-tenant environments. The
        vulnerability is caused when .NET Framework is used in
        high-load/high-density network connections where content
        from one stream can blend into another stream.
        (CVE-2018-8360)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly allow cross-frame
        interaction. An attacker who successfully exploited this
        vulnerability could allow an attacker to obtain browser
        frame or window state from a different domain. For an
        attack to be successful, an attacker must persuade a
        user to open a malicious website from a secure website.
        This update addresses the vulnerability by denying
        permission to read the state of the object model, to
        which frames or windows on different domains should not
        have access. (CVE-2018-8351)
    
      - An elevation of privilege vulnerability exists in
        Microsoft browsers allowing sandbox escape. An attacker
        who successfully exploited the vulnerability could use
        the sandbox escape to elevate privileges on an affected
        system. This vulnerability by itself does not allow
        arbitrary code execution; however, it could allow
        arbitrary code to be run if the attacker uses it in
        combination with another vulnerability (such as a remote
        code execution vulnerability or another elevation of
        privilege vulnerability) that is capable of leveraging
        the elevated privileges when code execution is
        attempted. (CVE-2018-8357)");
      # https://support.microsoft.com/en-us/help/4343892/windows-10-update-kb4343892
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e04d903e");
      # https://support.microsoft.com/en-us/help/4072698/windows-server-speculative-execution-side-channel-vulnerabilities-prot
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8902cebb");
      script_set_attribute(attribute:"solution", value:
      "Apply Cumulative Update KB4343892 as well as refer to the KB article for additional information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8344");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", 'microsoft_windows_env_vars.nasl');
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    include("smb_reg_query.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-08";
    kbs = make_list('4343892');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    
    if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"10",
                       sp:0,
                       os_build:"10240",
                       rollup_date:"08_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4343892])
      )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_AUG_4343900.NASL
    descriptionThe remote Windows host is missing security update 4343899 or cumulative update 4343900. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8403) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8341, CVE-2018-8348) - An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. (CVE-2018-8342, CVE-2018-8343) - A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8316) - An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage. The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory. (CVE-2018-8394, CVE-2018-8396, CVE-2018-8398) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385) - A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. (CVE-2018-8345, CVE-2018-8346) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373, CVE-2018-8389) - A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8397) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8404) - A remote code execution vulnerability exists in &quot;Microsoft COM for Windows&quot; when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-8349) - An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. (CVE-2018-8339) - An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments. The vulnerability is caused when .NET Framework is used in high-load/high-density network connections where content from one stream can blend into another stream. (CVE-2018-8360) - An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction. An attacker who successfully exploited this vulnerability could allow an attacker to obtain browser frame or window state from a different domain. For an attack to be successful, an attacker must persuade a user to open a malicious website from a secure website. This update addresses the vulnerability by denying permission to read the state of the object model, to which frames or windows on different domains should not have access. (CVE-2018-8351) - A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8344)
    last seen2020-06-01
    modified2020-06-02
    plugin id111689
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111689
    titleKB4343899: Windows 7 and Windows Server 2008 R2 August 2018 Security Update (Foreshadow)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(111689);
      script_version("1.16");
      script_cvs_date("Date: 2019/12/18");
    
      script_cve_id(
        "CVE-2018-3615",
        "CVE-2018-3620",
        "CVE-2018-3646",
        "CVE-2018-3665",
        "CVE-2018-8316",
        "CVE-2018-8339",
        "CVE-2018-8341",
        "CVE-2018-8342",
        "CVE-2018-8343",
        "CVE-2018-8344",
        "CVE-2018-8345",
        "CVE-2018-8346",
        "CVE-2018-8348",
        "CVE-2018-8349",
        "CVE-2018-8351",
        "CVE-2018-8353",
        "CVE-2018-8355",
        "CVE-2018-8360",
        "CVE-2018-8371",
        "CVE-2018-8372",
        "CVE-2018-8373",
        "CVE-2018-8385",
        "CVE-2018-8389",
        "CVE-2018-8394",
        "CVE-2018-8396",
        "CVE-2018-8397",
        "CVE-2018-8398",
        "CVE-2018-8403",
        "CVE-2018-8404"
      );
      script_bugtraq_id(
        104975,
        104978,
        104982,
        104983,
        104984,
        104986,
        104987,
        104992,
        104994,
        104995,
        104999,
        105001,
        105002,
        105027,
        105028,
        105030
      );
      script_xref(name:"MSKB", value:"4343899");
      script_xref(name:"MSKB", value:"4343900");
      script_xref(name:"MSFT", value:"MS18-4343899");
      script_xref(name:"MSFT", value:"MS18-4343900");
    
      script_name(english:"KB4343899: Windows 7 and Windows Server 2008 R2 August 2018 Security Update (Foreshadow)");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4343899
    or cumulative update 4343900. It is, therefore, affected by
    multiple vulnerabilities :
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8403)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8341, CVE-2018-8348)
    
      - An elevation of privilege vulnerability exists in the
        Network Driver Interface Specification (NDIS) when
        ndis.sys fails to check the length of a buffer prior to
        copying memory to it.  (CVE-2018-8342, CVE-2018-8343)
    
      - A remote code execution vulnerability exists when
        Internet Explorer improperly validates hyperlinks before
        loading executable libraries. An attacker who
        successfully exploited this vulnerability could take
        control of an affected system. An attacker could then
        install programs; view, change, or delete data; or
        create new accounts with full user rights.
        (CVE-2018-8316)
    
      - An information disclosure vulnerability exists when the
        Windows GDI component improperly discloses the contents
        of its memory. An attacker who successfully exploited
        the vulnerability could obtain information to further
        compromise the users system. There are multiple ways an
        attacker could exploit the vulnerability, such as by
        convincing a user to open a specially crafted document,
        or by convincing a user to visit an untrusted webpage.
        The security update addresses the vulnerability by
        correcting how the Windows GDI component handles objects
        in memory. (CVE-2018-8394, CVE-2018-8396, CVE-2018-8398)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385)
    
      - A remote code execution vulnerability exists in
        Microsoft Windows that could allow remote code execution
        if a .LNK file is processed. An attacker who
        successfully exploited this vulnerability could gain the
        same user rights as the local user.  (CVE-2018-8345,
        CVE-2018-8346)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373,
        CVE-2018-8389)
    
      - A remote code execution vulnerability exists in the way
        that the Windows Graphics Device Interface (GDI) handles
        objects in the memory. An attacker who successfully
        exploited this vulnerability could take control of the
        affected system. An attacker could then install
        programs; view, change, or delete data; or create new
        accounts with full user rights.  (CVE-2018-8397)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8404)
    
      - A remote code execution vulnerability exists in
        &quot;Microsoft COM for Windows&quot; when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-8349)
    
      - An elevation of privilege vulnerability exists in the
        Windows Installer when the Windows Installer fails to
        properly sanitize input leading to an insecure library
        loading behavior. A locally authenticated attacker could
        run arbitrary code with elevated system privileges. An
        attacker could then install programs; view, change, or
        delete data; or create new accounts with full user
        rights. The security update addresses the vulnerability
        by correcting the input sanitization error to preclude
        unintended elevation. (CVE-2018-8339)
    
      - An information disclosure vulnerability exists in
        Microsoft .NET Framework that could allow an attacker to
        access information in multi-tenant environments. The
        vulnerability is caused when .NET Framework is used in
        high-load/high-density network connections where content
        from one stream can blend into another stream.
        (CVE-2018-8360)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly allow cross-frame
        interaction. An attacker who successfully exploited this
        vulnerability could allow an attacker to obtain browser
        frame or window state from a different domain. For an
        attack to be successful, an attacker must persuade a
        user to open a malicious website from a secure website.
        This update addresses the vulnerability by denying
        permission to read the state of the object model, to
        which frames or windows on different domains should not
        have access. (CVE-2018-8351)
    
      - A remote code execution vulnerability exists when the
        Windows font library improperly handles specially
        crafted embedded fonts. An attacker who successfully
        exploited the vulnerability could take control of the
        affected system. An attacker could then install
        programs; view, change, or delete data; or create new
        accounts with full user rights.  (CVE-2018-8344)");
      # https://support.microsoft.com/en-us/help/4343899/windows-7-update-kb4343899
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3a469b20");
      # https://support.microsoft.com/en-us/help/4343900/windows-7-update-kb4343900
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c7990c33");
      # https://support.microsoft.com/en-us/help/4072698/windows-server-speculative-execution-side-channel-vulnerabilities-prot
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8902cebb");
      script_set_attribute(attribute:"solution", value:
    "Apply Security Only update KB4343899 or Cumulative Update KB4343900
    as well as refer to the KB article for additional information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8346");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", 'microsoft_windows_env_vars.nasl');
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    include("smb_reg_query.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-08";
    kbs = make_list('4343899', '4343900');
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win7:'1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"6.1",
                       sp:1,
                       rollup_date:"08_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4343899, 4343900])
      )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_AUG_4343909.NASL
    descriptionThe remote Windows host is missing security update 4343909. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8341, CVE-2018-8348) - A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8344) - A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8377, CVE-2018-8387) - An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. (CVE-2018-8343) - A remote code execution vulnerability exists in &quot;Microsoft COM for Windows&quot; when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-8349) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8400, CVE-2018-8401, CVE-2018-8405, CVE-2018-8406) - A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8390) - A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths. An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user. If the current user is logged on as an administrator, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with elevated privileges. Users whose accounts are configured to have fewer privileges on the system could be less impacted than users who operate with administrative privileges. (CVE-2018-8414) - A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could trick a user by redirecting the user to a specially crafted website. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2018-8383) - A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session. An attacker who successfully exploited this vulnerability could inject code into a trusted PowerShell process to bypass the Device Guard Code Integrity policy on the local machine. (CVE-2018-8200, CVE-2018-8204) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385) - An elevation of privilege vulnerability exists in Microsoft Windows when the Windows kernel fails to properly handle parsing of certain symbolic links. An attacker who successfully exploited this vulnerability could potentially access privileged registry keys and thereby elevate permissions. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8347) - A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8350) - A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. (CVE-2018-8345) - A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests. An attacker who has successfully exploited this vulnerability might be able to read privileged data across trust boundaries. In browsing scenarios, an attacker could convince a user to visit a malicious site and leverage the vulnerability to obtain privileged information from the browser process, such as sensitive data from other opened tabs. An attacker could also inject malicious code into advertising networks used by trusted sites or embed malicious code on a compromised, but trusted, site. The update addresses the vulnerability by correcting how the WebAudio Library handles audio requests. (CVE-2018-8370) - An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. (CVE-2018-8339) - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8266, CVE-2018-8380, CVE-2018-8381) - A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8316) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8399, CVE-2018-8404) - An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage. The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory. (CVE-2018-8394, CVE-2018-8398) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8403) - An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction. An attacker who successfully exploited this vulnerability could allow an attacker to obtain browser frame or window state from a different domain. For an attack to be successful, an attacker must persuade a user to open a malicious website from a secure website. This update addresses the vulnerability by denying permission to read the state of the object model, to which frames or windows on different domains should not have access. (CVE-2018-8351) - An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system. This vulnerability by itself does not allow arbitrary code execution; however, it could allow arbitrary code to be run if the attacker uses it in combination with another vulnerability (such as a remote code execution vulnerability or another elevation of privilege vulnerability) that is capable of leveraging the elevated privileges when code execution is attempted. (CVE-2018-8357) - An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations. (CVE-2018-0952) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373, CVE-2018-8389) - An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments. The vulnerability is caused when .NET Framework is used in high-load/high-density network connections where content from one stream can blend into another stream. (CVE-2018-8360) - A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content. An attacker who successfully exploited this vulnerability could trick a user into believing that the user was on a legitimate website. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2018-8388)
    last seen2020-06-01
    modified2020-06-02
    plugin id111692
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111692
    titleKB4343909: Windows 10 Version 1803 and Windows Server Version 1803 August 2018 Security Update (Foreshadow)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(111692);
      script_version("1.16");
      script_cvs_date("Date: 2019/12/18");
    
      script_cve_id(
        "CVE-2018-0952",
        "CVE-2018-3615",
        "CVE-2018-3620",
        "CVE-2018-3646",
        "CVE-2018-8200",
        "CVE-2018-8204",
        "CVE-2018-8266",
        "CVE-2018-8316",
        "CVE-2018-8339",
        "CVE-2018-8341",
        "CVE-2018-8343",
        "CVE-2018-8344",
        "CVE-2018-8345",
        "CVE-2018-8347",
        "CVE-2018-8348",
        "CVE-2018-8349",
        "CVE-2018-8350",
        "CVE-2018-8351",
        "CVE-2018-8353",
        "CVE-2018-8355",
        "CVE-2018-8357",
        "CVE-2018-8360",
        "CVE-2018-8370",
        "CVE-2018-8371",
        "CVE-2018-8372",
        "CVE-2018-8373",
        "CVE-2018-8377",
        "CVE-2018-8380",
        "CVE-2018-8381",
        "CVE-2018-8383",
        "CVE-2018-8385",
        "CVE-2018-8387",
        "CVE-2018-8388",
        "CVE-2018-8389",
        "CVE-2018-8390",
        "CVE-2018-8394",
        "CVE-2018-8398",
        "CVE-2018-8399",
        "CVE-2018-8400",
        "CVE-2018-8401",
        "CVE-2018-8403",
        "CVE-2018-8404",
        "CVE-2018-8405",
        "CVE-2018-8406",
        "CVE-2018-8414"
      );
      script_xref(name:"MSKB", value:"4343909");
      script_xref(name:"MSFT", value:"MS18-4343909");
    
      script_name(english:"KB4343909: Windows 10 Version 1803 and Windows Server Version 1803 August 2018 Security Update (Foreshadow)");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4343909.
    It is, therefore, affected by multiple vulnerabilities :
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8341, CVE-2018-8348)
    
      - A remote code execution vulnerability exists when the
        Windows font library improperly handles specially
        crafted embedded fonts. An attacker who successfully
        exploited the vulnerability could take control of the
        affected system. An attacker could then install
        programs; view, change, or delete data; or create new
        accounts with full user rights.  (CVE-2018-8344)
    
      - A remote code execution vulnerability exists when
        Microsoft Edge improperly accesses objects in memory.
        The vulnerability could corrupt memory in such a way
        that enables an attacker to execute arbitrary code in
        the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8377,
        CVE-2018-8387)
    
      - An elevation of privilege vulnerability exists in the
        Network Driver Interface Specification (NDIS) when
        ndis.sys fails to check the length of a buffer prior to
        copying memory to it.  (CVE-2018-8343)
    
      - A remote code execution vulnerability exists in
        &quot;Microsoft COM for Windows&quot; when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-8349)
    
      - An elevation of privilege vulnerability exists when the
        DirectX Graphics Kernel (DXGKRNL) driver improperly
        handles objects in memory. An attacker who successfully
        exploited this vulnerability could run processes in an
        elevated context.  (CVE-2018-8400, CVE-2018-8401,
        CVE-2018-8405, CVE-2018-8406)
    
      - A remote code execution vulnerability exists in the way
        that the ChakraCore scripting engine handles objects in
        memory. The vulnerability could corrupt memory in such a
        way that an attacker could execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8390)
    
      - A remote code execution vulnerability exists when the
        Windows Shell does not properly validate file paths. An
        attacker who successfully exploited this vulnerability
        could run arbitrary code in the context of the current
        user. If the current user is logged on as an
        administrator, an attacker could take control of the
        affected system. An attacker could then install
        programs; view, change, or delete data; or create new
        accounts with elevated privileges. Users whose accounts
        are configured to have fewer privileges on the system
        could be less impacted than users who operate with
        administrative privileges.  (CVE-2018-8414)
    
      - A spoofing vulnerability exists when Microsoft Edge does
        not properly parse HTTP content. An attacker who
        successfully exploited this vulnerability could trick a
        user by redirecting the user to a specially crafted
        website. The specially crafted website could either
        spoof content or serve as a pivot to chain an attack
        with other vulnerabilities in web services.
        (CVE-2018-8383)
    
      - A security feature bypass vulnerability exists in Device
        Guard that could allow an attacker to inject malicious
        code into a Windows PowerShell session. An attacker who
        successfully exploited this vulnerability could inject
        code into a trusted PowerShell process to bypass the
        Device Guard Code Integrity policy on the local machine.
        (CVE-2018-8200, CVE-2018-8204)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385)
    
      - An elevation of privilege vulnerability exists in
        Microsoft Windows when the Windows kernel fails to
        properly handle parsing of certain symbolic links. An
        attacker who successfully exploited this vulnerability
        could potentially access privileged registry keys and
        thereby elevate permissions. An attacker could then
        install programs; view, change, or delete data; or
        create new accounts with full user rights.
        (CVE-2018-8347)
    
      - A remote code execution vulnerability exists when
        Microsoft Windows PDF Library improperly handles objects
        in memory. The vulnerability could corrupt memory in a
        way that enables an attacker to execute arbitrary code
        in the context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user. If the current
        user is logged on with administrative user rights, an
        attacker could take control of an affected system. An
        attacker could then install programs; view, change, or
        delete data; or create new accounts with full user
        rights.  (CVE-2018-8350)
    
      - A remote code execution vulnerability exists in
        Microsoft Windows that could allow remote code execution
        if a .LNK file is processed. An attacker who
        successfully exploited this vulnerability could gain the
        same user rights as the local user.  (CVE-2018-8345)
    
      - A information disclosure vulnerability exists when
        WebAudio Library improperly handles audio requests. An
        attacker who has successfully exploited this
        vulnerability might be able to read privileged data
        across trust boundaries. In browsing scenarios, an
        attacker could convince a user to visit a malicious site
        and leverage the vulnerability to obtain privileged
        information from the browser process, such as sensitive
        data from other opened tabs. An attacker could also
        inject malicious code into advertising networks used by
        trusted sites or embed malicious code on a compromised,
        but trusted, site. The update addresses the
        vulnerability by correcting how the WebAudio Library
        handles audio requests. (CVE-2018-8370)
    
      - An elevation of privilege vulnerability exists in the
        Windows Installer when the Windows Installer fails to
        properly sanitize input leading to an insecure library
        loading behavior. A locally authenticated attacker could
        run arbitrary code with elevated system privileges. An
        attacker could then install programs; view, change, or
        delete data; or create new accounts with full user
        rights. The security update addresses the vulnerability
        by correcting the input sanitization error to preclude
        unintended elevation. (CVE-2018-8339)
    
      - A remote code execution vulnerability exists in the way
        that the Chakra scripting engine handles objects in
        memory in Microsoft Edge. The vulnerability could
        corrupt memory in such a way that an attacker could
        execute arbitrary code in the context of the current
        user. An attacker who successfully exploited the
        vulnerability could gain the same user rights as the
        current user.  (CVE-2018-8266, CVE-2018-8380,
        CVE-2018-8381)
    
      - A remote code execution vulnerability exists when
        Internet Explorer improperly validates hyperlinks before
        loading executable libraries. An attacker who
        successfully exploited this vulnerability could take
        control of an affected system. An attacker could then
        install programs; view, change, or delete data; or
        create new accounts with full user rights.
        (CVE-2018-8316)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8399, CVE-2018-8404)
    
      - An information disclosure vulnerability exists when the
        Windows GDI component improperly discloses the contents
        of its memory. An attacker who successfully exploited
        the vulnerability could obtain information to further
        compromise the users system. There are multiple ways an
        attacker could exploit the vulnerability, such as by
        convincing a user to open a specially crafted document,
        or by convincing a user to visit an untrusted webpage.
        The security update addresses the vulnerability by
        correcting how the Windows GDI component handles objects
        in memory. (CVE-2018-8394, CVE-2018-8398)
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8403)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly allow cross-frame
        interaction. An attacker who successfully exploited this
        vulnerability could allow an attacker to obtain browser
        frame or window state from a different domain. For an
        attack to be successful, an attacker must persuade a
        user to open a malicious website from a secure website.
        This update addresses the vulnerability by denying
        permission to read the state of the object model, to
        which frames or windows on different domains should not
        have access. (CVE-2018-8351)
    
      - An elevation of privilege vulnerability exists in
        Microsoft browsers allowing sandbox escape. An attacker
        who successfully exploited the vulnerability could use
        the sandbox escape to elevate privileges on an affected
        system. This vulnerability by itself does not allow
        arbitrary code execution; however, it could allow
        arbitrary code to be run if the attacker uses it in
        combination with another vulnerability (such as a remote
        code execution vulnerability or another elevation of
        privilege vulnerability) that is capable of leveraging
        the elevated privileges when code execution is
        attempted. (CVE-2018-8357)
    
      - An Elevation of Privilege vulnerability exists when
        Diagnostics Hub Standard Collector allows file creation
        in arbitrary locations.  (CVE-2018-0952)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373,
        CVE-2018-8389)
    
      - An information disclosure vulnerability exists in
        Microsoft .NET Framework that could allow an attacker to
        access information in multi-tenant environments. The
        vulnerability is caused when .NET Framework is used in
        high-load/high-density network connections where content
        from one stream can blend into another stream.
        (CVE-2018-8360)
    
      - A spoofing vulnerability exists when Microsoft Edge
        improperly handles specific HTML content. An attacker
        who successfully exploited this vulnerability could
        trick a user into believing that the user was on a
        legitimate website. The specially crafted website could
        either spoof content or serve as a pivot to chain an
        attack with other vulnerabilities in web services.
        (CVE-2018-8388)");
      # https://support.microsoft.com/en-us/help/4343909/windows-10-update-kb4343909
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3356f605");
      # https://support.microsoft.com/en-us/help/4072698/windows-server-speculative-execution-side-channel-vulnerabilities-prot
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8902cebb");
      script_set_attribute(attribute:"solution", value:
      "Apply Cumulative Update KB4343909 as well as refer to the KB article for additional information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8344");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", 'microsoft_windows_env_vars.nasl');
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    include("smb_reg_query.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-08";
    kbs = make_list('4343909');
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"10",
                       sp:0,
                       os_build:"17134",
                       rollup_date:"08_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4343909])
      )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_AUG_4343901.NASL
    descriptionThe remote Windows host is missing security update 4343896 or cumulative update 4343901. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8403) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8341, CVE-2018-8348) - A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8344) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8385) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8404) - A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8316) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373, CVE-2018-8389) - A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. (CVE-2018-8345) - An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. (CVE-2018-8343) - An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage. The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory. (CVE-2018-8394, CVE-2018-8398) - A remote code execution vulnerability exists in &quot;Microsoft COM for Windows&quot; when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-8349) - An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. (CVE-2018-8339) - An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments. The vulnerability is caused when .NET Framework is used in high-load/high-density network connections where content from one stream can blend into another stream. (CVE-2018-8360) - An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction. An attacker who successfully exploited this vulnerability could allow an attacker to obtain browser frame or window state from a different domain. For an attack to be successful, an attacker must persuade a user to open a malicious website from a secure website. This update addresses the vulnerability by denying permission to read the state of the object model, to which frames or windows on different domains should not have access. (CVE-2018-8351)
    last seen2020-06-01
    modified2020-06-02
    plugin id111690
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111690
    titleKB4343896: Windows Server 2012 August 2018 Security Update (Foreshadow)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(111690);
      script_version("1.16");
      script_cvs_date("Date: 2019/12/18");
    
      script_cve_id(
        "CVE-2018-3615",
        "CVE-2018-3620",
        "CVE-2018-3646",
        "CVE-2018-8316",
        "CVE-2018-8339",
        "CVE-2018-8341",
        "CVE-2018-8343",
        "CVE-2018-8344",
        "CVE-2018-8345",
        "CVE-2018-8348",
        "CVE-2018-8349",
        "CVE-2018-8351",
        "CVE-2018-8353",
        "CVE-2018-8360",
        "CVE-2018-8371",
        "CVE-2018-8373",
        "CVE-2018-8385",
        "CVE-2018-8389",
        "CVE-2018-8394",
        "CVE-2018-8398",
        "CVE-2018-8403",
        "CVE-2018-8404"
      );
      script_bugtraq_id(
        104982,
        104983,
        104984,
        104986,
        104987,
        104992,
        104995,
        104999,
        105001,
        105027,
        105030
      );
      script_xref(name:"MSKB", value:"4343896");
      script_xref(name:"MSKB", value:"4343901");
      script_xref(name:"MSFT", value:"MS18-4343896");
      script_xref(name:"MSFT", value:"MS18-4343901");
    
      script_name(english:"KB4343896: Windows Server 2012 August 2018 Security Update (Foreshadow)");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4343896
    or cumulative update 4343901. It is, therefore, affected by
    multiple vulnerabilities :
    
      - A remote code execution vulnerability exists in the way
        that Microsoft browsers access objects in memory. The
        vulnerability could corrupt memory in a way that could
        allow an attacker to execute arbitrary code in the
        context of the current user. An attacker who
        successfully exploited the vulnerability could gain the
        same user rights as the current user.  (CVE-2018-8403)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8341, CVE-2018-8348)
    
      - A remote code execution vulnerability exists when the
        Windows font library improperly handles specially
        crafted embedded fonts. An attacker who successfully
        exploited the vulnerability could take control of the
        affected system. An attacker could then install
        programs; view, change, or delete data; or create new
        accounts with full user rights.  (CVE-2018-8344)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-8385)
    
      - An elevation of privilege vulnerability exists in
        Windows when the Win32k component fails to properly
        handle objects in memory. An attacker who successfully
        exploited this vulnerability could run arbitrary code in
        kernel mode. An attacker could then install programs;
        view, change, or delete data; or create new accounts
        with full user rights.  (CVE-2018-8404)
    
      - A remote code execution vulnerability exists when
        Internet Explorer improperly validates hyperlinks before
        loading executable libraries. An attacker who
        successfully exploited this vulnerability could take
        control of an affected system. An attacker could then
        install programs; view, change, or delete data; or
        create new accounts with full user rights.
        (CVE-2018-8316)
    
      - A remote code execution vulnerability exists in the way
        that the scripting engine handles objects in memory in
        Internet Explorer. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373,
        CVE-2018-8389)
    
      - A remote code execution vulnerability exists in
        Microsoft Windows that could allow remote code execution
        if a .LNK file is processed. An attacker who
        successfully exploited this vulnerability could gain the
        same user rights as the local user.  (CVE-2018-8345)
    
      - An elevation of privilege vulnerability exists in the
        Network Driver Interface Specification (NDIS) when
        ndis.sys fails to check the length of a buffer prior to
        copying memory to it.  (CVE-2018-8343)
    
      - An information disclosure vulnerability exists when the
        Windows GDI component improperly discloses the contents
        of its memory. An attacker who successfully exploited
        the vulnerability could obtain information to further
        compromise the users system. There are multiple ways an
        attacker could exploit the vulnerability, such as by
        convincing a user to open a specially crafted document,
        or by convincing a user to visit an untrusted webpage.
        The security update addresses the vulnerability by
        correcting how the Windows GDI component handles objects
        in memory. (CVE-2018-8394, CVE-2018-8398)
    
      - A remote code execution vulnerability exists in
        &quot;Microsoft COM for Windows&quot; when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-8349)
    
      - An elevation of privilege vulnerability exists in the
        Windows Installer when the Windows Installer fails to
        properly sanitize input leading to an insecure library
        loading behavior. A locally authenticated attacker could
        run arbitrary code with elevated system privileges. An
        attacker could then install programs; view, change, or
        delete data; or create new accounts with full user
        rights. The security update addresses the vulnerability
        by correcting the input sanitization error to preclude
        unintended elevation. (CVE-2018-8339)
    
      - An information disclosure vulnerability exists in
        Microsoft .NET Framework that could allow an attacker to
        access information in multi-tenant environments. The
        vulnerability is caused when .NET Framework is used in
        high-load/high-density network connections where content
        from one stream can blend into another stream.
        (CVE-2018-8360)
    
      - An information disclosure vulnerability exists when
        affected Microsoft browsers improperly allow cross-frame
        interaction. An attacker who successfully exploited this
        vulnerability could allow an attacker to obtain browser
        frame or window state from a different domain. For an
        attack to be successful, an attacker must persuade a
        user to open a malicious website from a secure website.
        This update addresses the vulnerability by denying
        permission to read the state of the object model, to
        which frames or windows on different domains should not
        have access. (CVE-2018-8351)");
      # https://support.microsoft.com/en-us/help/4343896/windows-server-2012-update-kb4343896
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?55516671");
      # https://support.microsoft.com/en-us/help/4343901/windows-server-2012-update-kb4343901
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f8d177a9");
      # https://support.microsoft.com/en-us/help/4072698/windows-server-speculative-execution-side-channel-vulnerabilities-prot
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8902cebb");
      script_set_attribute(attribute:"solution", value:
    "Apply Security Only update KB4343896 or Cumulative Update KB4343901
    as well as refer to the KB article for additional information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8346");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", 'microsoft_windows_env_vars.nasl');
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    include("smb_reg_query.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-08";
    kbs = make_list('4343896', '4343901');
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win8:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    
    # Windows 8 EOL
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Windows 8" >< productname) audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      smb_check_rollup(os:"6.2",
                       sp:0,
                       rollup_date:"08_2018",
                       bulletin:bulletin,
                       rollup_kb_list:[4343896, 4343901])
      )
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_AUG_WIN2008.NASL
    descriptionThe remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - Errors exist related to microprocessors utilizing speculative execution and L1 data cache that could allow information disclosure. (CVE-2018-3615, CVE-2018-3620, CVE-2018-3646) - A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8344) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8385) - A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. (CVE-2018-8345, CVE-2018-8346) - An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage. The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory. (CVE-2018-8394, CVE-2018-8396, CVE-2018-8398) - A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8397) - A remote code execution vulnerability exists in
    last seen2020-06-01
    modified2020-06-02
    plugin id111700
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111700
    titleSecurity Updates for Windows Server 2008 (August 2018) (Foreshadow)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(111700);
      script_version("1.12");
      script_cvs_date("Date: 2019/12/18");
    
      script_cve_id(
        "CVE-2018-3615",
        "CVE-2018-3620",
        "CVE-2018-3646",
        "CVE-2018-8339",
        "CVE-2018-8344",
        "CVE-2018-8345",
        "CVE-2018-8346",
        "CVE-2018-8348",
        "CVE-2018-8349",
        "CVE-2018-8394",
        "CVE-2018-8396",
        "CVE-2018-8397",
        "CVE-2018-8398"
      );
      script_bugtraq_id(
        104983,
        104984,
        104992,
        104994,
        104995,
        105001,
        105002,
        105027,
        105028,
        105030,
        105080
      );
      script_xref(name:"MSKB", value:"4338380");
      script_xref(name:"MSKB", value:"4340937");
      script_xref(name:"MSKB", value:"4340939");
      script_xref(name:"MSKB", value:"4341832");
      script_xref(name:"MSKB", value:"4343674");
      script_xref(name:"MSKB", value:"4344104");
      script_xref(name:"MSFT", value:"MS18-4338380");
      script_xref(name:"MSFT", value:"MS18-4340937");
      script_xref(name:"MSFT", value:"MS18-4340939");
      script_xref(name:"MSFT", value:"MS18-4341832");
      script_xref(name:"MSFT", value:"MS18-4343674");
      script_xref(name:"MSFT", value:"MS18-4344104");
    
      script_name(english:"Security Updates for Windows Server 2008 (August 2018) (Foreshadow)");
      script_summary(english:"Checks for Microsoft security updates.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security updates. It is,
    therefore, affected by multiple vulnerabilities :
    
      - Errors exist related to microprocessors utilizing
        speculative execution and L1 data cache that could
        allow information disclosure. (CVE-2018-3615,
        CVE-2018-3620, CVE-2018-3646)
    
      - A remote code execution vulnerability exists when the
        Windows font library improperly handles specially
        crafted embedded fonts. An attacker who successfully
        exploited the vulnerability could take control of the
        affected system. An attacker could then install
        programs; view, change, or delete data; or create new
        accounts with full user rights.  (CVE-2018-8344)
    
      - A remote code execution vulnerability exists in the way
        the scripting engine handles objects in memory in
        Microsoft browsers. The vulnerability could corrupt
        memory in such a way that an attacker could execute
        arbitrary code in the context of the current user. An
        attacker who successfully exploited the vulnerability
        could gain the same user rights as the current user.
        (CVE-2018-8385)
    
      - A remote code execution vulnerability exists in
        Microsoft Windows that could allow remote code execution
        if a .LNK file is processed. An attacker who
        successfully exploited this vulnerability could gain the
        same user rights as the local user.  (CVE-2018-8345,
        CVE-2018-8346)
    
      - An information disclosure vulnerability exists when the
        Windows GDI component improperly discloses the contents
        of its memory. An attacker who successfully exploited
        the vulnerability could obtain information to further
        compromise the users system. There are multiple ways an
        attacker could exploit the vulnerability, such as by
        convincing a user to open a specially crafted document,
        or by convincing a user to visit an untrusted webpage.
        The security update addresses the vulnerability by
        correcting how the Windows GDI component handles objects
        in memory. (CVE-2018-8394, CVE-2018-8396, CVE-2018-8398)
    
      - A remote code execution vulnerability exists in the way
        that the Windows Graphics Device Interface (GDI) handles
        objects in the memory. An attacker who successfully
        exploited this vulnerability could take control of the
        affected system. An attacker could then install
        programs; view, change, or delete data; or create new
        accounts with full user rights.  (CVE-2018-8397)
    
      - A remote code execution vulnerability exists in
        'Microsoft COM for Windows' when it fails to
        properly handle serialized objects. An attacker who
        successfully exploited the vulnerability could use a
        specially crafted file or script to perform actions. In
        an email attack scenario, an attacker could exploit the
        vulnerability by sending the specially crafted file to
        the user and convincing the user to open the file.
        (CVE-2018-8349)
    
      - An elevation of privilege vulnerability exists in the
        Windows Installer when the Windows Installer fails to
        properly sanitize input leading to an insecure library
        loading behavior. A locally authenticated attacker could
        run arbitrary code with elevated system privileges. An
        attacker could then install programs; view, change, or
        delete data; or create new accounts with full user
        rights. The security update addresses the vulnerability
        by correcting the input sanitization error to preclude
        unintended elevation. (CVE-2018-8339)
    
      - An information disclosure vulnerability exists when the
        Windows kernel improperly handles objects in memory. An
        attacker who successfully exploited this vulnerability
        could obtain information to further compromise the users
        system.  (CVE-2018-8348)");
      # https://support.microsoft.com/en-us/help/4338380/security-update-for-vulnerabilities-in-windows-server-2008
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1277e89e");
      # https://support.microsoft.com/en-us/help/4341832/security-update-for-vulnerabilities-in-windows-server-2008
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b27d8590");
      # https://support.microsoft.com/en-us/help/4340937/security-update-for-the-microsoft-com-vulnerabilities-in-windows
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?03764b1c");
      # https://support.microsoft.com/en-us/help/4344104/security-update-for-font-library-vulnerability-in-windows
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8782f358");
      # https://support.microsoft.com/en-us/help/4343674/security-update-for-gdi-vulnerabilities-in-windows
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3f77c369");
      # https://support.microsoft.com/en-us/help/4340939/security-update-for-vulnerabilities-in-windows-server-2008
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?09c0d01f");
      # https://blogs.technet.microsoft.com/srd/2018/08/10/analysis-and-mitigation-of-l1-terminal-fault-l1tf/
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?818d7d6a");
      # https://support.microsoft.com/en-us/help/4072698/windows-server-speculative-execution-side-channel-vulnerabilities-prot
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8902cebb");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released security updates for Windows Server 2008.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8344");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"in_the_news", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", "microsoft_windows_env_vars.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("misc_func.inc");
    include("smb_reg_query.inc");
    include("lists.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = 'MS18-08';
    
    kbs = make_list(
      '4338380',
      '4340937',
      '4340939',
      '4341832',
      '4343674',
      '4344104'
    );
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    # KBs only apply to Windows 2008
    if (hotfix_check_sp_range(vista:'2') <= 0)
      audit(AUDIT_OS_SP_NOT_VULN);
    
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Vista" >< productname) audit(AUDIT_OS_SP_NOT_VULN);
    
    systemroot = hotfix_get_systemroot();
    if (!systemroot) audit(AUDIT_PATH_NOT_DETERMINED, 'system root');
    
    port   = kb_smb_transport();
    login  = kb_smb_login();
    pass   = kb_smb_password();
    domain = kb_smb_domain();
    
    if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');
    
    winsxs = ereg_replace(pattern:'^[A-Za-z]:(.*)', replace:"\1\WinSxS", string:systemroot);
    winsxs_share = hotfix_path2share(path:systemroot);
    
    rc = NetUseAdd(login:login, password:pass, domain:domain, share:winsxs_share);
    if (rc != 1)
    {
      NetUseDel();
      audit(AUDIT_SHARE_FAIL, winsxs_share);
    }
    
    the_session = make_array(
      'login',    login,
      'password', pass,
      'domain',   domain,
      'share',    winsxs_share
    );
    
    vuln = 0;
    
    
    # KB4338380
    files = list_dir(basedir:winsxs, level:0, dir_pat:"offlinefiles-core_31bf3856ad364e35", file_pat:"^csc\.sys$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('6.0.6002.24436'),
                                max_versions:make_list('6.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4338380", session:the_session);
    
    # KB4340937
    files = list_dir(basedir:winsxs, level:0, dir_pat:"installer-engine_31bf3856ad364e35", file_pat:"^msi\.dll$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('4.5.6002.24433'),
                                max_versions:make_list('4.5.6002.99999'),
                                bulletin:bulletin,
                                kb:"4340937", session:the_session);
    
    # KB4340939
    files = list_dir(basedir:winsxs, level:0, dir_pat:"structuredquery_31bf3856ad364e35", file_pat:"^msshsq\.dll$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('7.0.6002.24434'),
                                max_versions:make_list('7.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4340939", session:the_session);
    
    # KB4341832
    files = list_dir(basedir:winsxs, level:0, dir_pat:"os-kernel_31bf3856ad364e35", file_pat:"^ntoskrnl\.exe$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('6.0.6002.24444'),
                                max_versions:make_list('6.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4341832", session:the_session);
    
    # KB4343674
    files = list_dir(basedir:winsxs, level:0, dir_pat:"gdi-painting_31bf3856ad364e35", file_pat:"^msimg32\.dll$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('6.0.6002.24439'),
                                max_versions:make_list('6.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4343674", session:the_session);
    
    # KB4344104
    files = list_dir(basedir:winsxs, level:0, dir_pat:"-gdi_31bf3856ad364e35", file_pat:"^dciman32\.dll$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('6.0.6002.24441'),
                                max_versions:make_list('6.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4344104", session:the_session);
    
    hotfix_check_fversion_end();
    NetUseDel();
    
    if (vuln > 0)
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      exit(0);
    }
    else
    {
      audit(AUDIT_HOST_NOT, 'affected');
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_AUG_4343898.NASL
    descriptionThe remote Windows host is missing security update 4343888 or cumulative update 4343898. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8403) - An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments. The vulnerability is caused when .NET Framework is used in high-load/high-density network connections where content from one stream can blend into another stream. (CVE-2018-8360) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8341, CVE-2018-8348) - A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8344) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8404) - A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8316) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373, CVE-2018-8389) - A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. (CVE-2018-8345) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8405) - An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. (CVE-2018-8343) - An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage. The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory. (CVE-2018-8394, CVE-2018-8398) - A remote code execution vulnerability exists in &quot;Microsoft COM for Windows&quot; when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-8349) - An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. (CVE-2018-8339) - A security feature bypass vulnerability exists when Active Directory Federation Services (AD FS) improperly handles multi-factor authentication requests. (CVE-2018-8340) - An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction. An attacker who successfully exploited this vulnerability could allow an attacker to obtain browser frame or window state from a different domain. For an attack to be successful, an attacker must persuade a user to open a malicious website from a secure website. This update addresses the vulnerability by denying permission to read the state of the object model, to which frames or windows on different domains should not have access. (CVE-2018-8351)
    last seen2020-06-01
    modified2020-06-02
    plugin id111688
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111688
    titleKB4343888: Windows 8.1 and Windows Server 2012 R2 August 2018 Security Update (Foreshadow)
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_AUG_4343897.NASL
    descriptionThe remote Windows host is missing security update 4343897. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8341, CVE-2018-8348) - A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8344) - An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. (CVE-2018-8343) - A remote code execution vulnerability exists in &quot;Microsoft COM for Windows&quot; when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-8349) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8400, CVE-2018-8401, CVE-2018-8405, CVE-2018-8406) - A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8390) - A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths. An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user. If the current user is logged on as an administrator, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with elevated privileges. Users whose accounts are configured to have fewer privileges on the system could be less impacted than users who operate with administrative privileges. (CVE-2018-8414) - A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session. An attacker who successfully exploited this vulnerability could inject code into a trusted PowerShell process to bypass the Device Guard Code Integrity policy on the local machine. (CVE-2018-8200, CVE-2018-8204) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385) - An elevation of privilege vulnerability exists in Microsoft Windows when the Windows kernel fails to properly handle parsing of certain symbolic links. An attacker who successfully exploited this vulnerability could potentially access privileged registry keys and thereby elevate permissions. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8347) - A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8350) - A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. (CVE-2018-8345) - A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests. An attacker who has successfully exploited this vulnerability might be able to read privileged data across trust boundaries. In browsing scenarios, an attacker could convince a user to visit a malicious site and leverage the vulnerability to obtain privileged information from the browser process, such as sensitive data from other opened tabs. An attacker could also inject malicious code into advertising networks used by trusted sites or embed malicious code on a compromised, but trusted, site. The update addresses the vulnerability by correcting how the WebAudio Library handles audio requests. (CVE-2018-8370) - An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. (CVE-2018-8339) - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8266, CVE-2018-8381) - A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8316) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8399, CVE-2018-8404) - An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage. The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory. (CVE-2018-8394, CVE-2018-8398) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8403) - An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction. An attacker who successfully exploited this vulnerability could allow an attacker to obtain browser frame or window state from a different domain. For an attack to be successful, an attacker must persuade a user to open a malicious website from a secure website. This update addresses the vulnerability by denying permission to read the state of the object model, to which frames or windows on different domains should not have access. (CVE-2018-8351) - An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system. This vulnerability by itself does not allow arbitrary code execution; however, it could allow arbitrary code to be run if the attacker uses it in combination with another vulnerability (such as a remote code execution vulnerability or another elevation of privilege vulnerability) that is capable of leveraging the elevated privileges when code execution is attempted. (CVE-2018-8357) - An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations. (CVE-2018-0952) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373, CVE-2018-8389) - A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8377) - An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments. The vulnerability is caused when .NET Framework is used in high-load/high-density network connections where content from one stream can blend into another stream. (CVE-2018-8360) - A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content. An attacker who successfully exploited this vulnerability could trick a user into believing that the user was on a legitimate website. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2018-8388)
    last seen2020-06-01
    modified2020-06-02
    plugin id111687
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111687
    titleKB4343897: Windows 10 Version 1709 And Windows Server Version 1709 August 2018 Security Update (Foreshadow)
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_AUG_4343885.NASL
    descriptionThe remote Windows host is missing security update 4343885. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8341, CVE-2018-8348) - A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8344) - An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. (CVE-2018-8343) - A remote code execution vulnerability exists in &quot;Microsoft COM for Windows&quot; when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-8349) - A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8390) - A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths. An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user. If the current user is logged on as an administrator, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with elevated privileges. Users whose accounts are configured to have fewer privileges on the system could be less impacted than users who operate with administrative privileges. (CVE-2018-8414) - A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session. An attacker who successfully exploited this vulnerability could inject code into a trusted PowerShell process to bypass the Device Guard Code Integrity policy on the local machine. (CVE-2018-8200, CVE-2018-8204) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385) - An elevation of privilege vulnerability exists in Microsoft Windows when the Windows kernel fails to properly handle parsing of certain symbolic links. An attacker who successfully exploited this vulnerability could potentially access privileged registry keys and thereby elevate permissions. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8347) - A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8350) - A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. (CVE-2018-8345) - A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests. An attacker who has successfully exploited this vulnerability might be able to read privileged data across trust boundaries. In browsing scenarios, an attacker could convince a user to visit a malicious site and leverage the vulnerability to obtain privileged information from the browser process, such as sensitive data from other opened tabs. An attacker could also inject malicious code into advertising networks used by trusted sites or embed malicious code on a compromised, but trusted, site. The update addresses the vulnerability by correcting how the WebAudio Library handles audio requests. (CVE-2018-8370) - An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. (CVE-2018-8339) - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8266, CVE-2018-8381) - A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8316) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8399, CVE-2018-8404) - An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage. The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory. (CVE-2018-8394, CVE-2018-8398) - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8403) - An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction. An attacker who successfully exploited this vulnerability could allow an attacker to obtain browser frame or window state from a different domain. For an attack to be successful, an attacker must persuade a user to open a malicious website from a secure website. This update addresses the vulnerability by denying permission to read the state of the object model, to which frames or windows on different domains should not have access. (CVE-2018-8351) - An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system. This vulnerability by itself does not allow arbitrary code execution; however, it could allow arbitrary code to be run if the attacker uses it in combination with another vulnerability (such as a remote code execution vulnerability or another elevation of privilege vulnerability) that is capable of leveraging the elevated privileges when code execution is attempted. (CVE-2018-8357) - An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations. (CVE-2018-0952) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373, CVE-2018-8389) - An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. (CVE-2018-8401, CVE-2018-8405, CVE-2018-8406) - An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments. The vulnerability is caused when .NET Framework is used in high-load/high-density network connections where content from one stream can blend into another stream. (CVE-2018-8360) - A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content. An attacker who successfully exploited this vulnerability could trick a user into believing that the user was on a legitimate website. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2018-8388)
    last seen2020-06-01
    modified2020-06-02
    plugin id111684
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111684
    titleKB4343885: Windows 10 Version 1703 August 2018 Security Update (Foreshadow)

The Hacker News

idTHN:F033FC8698702175A4736D089C3C9D13
last seen2018-08-14
modified2018-08-14
published2018-08-14
reporterThe Hacker News
sourcehttps://thehackernews.com/2018/08/microsoft-patch-updates.html
titleMicrosoft Releases Patches for 60 Flaws—Two Under Active Attack