Kaspersky Threats

Beschreibung

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, bypass security restrictions, cause a denial of service and obtain sensitive information.

Below is a complete list of vulnerabilities:

An improper handling of embedded fonts in Windows font library can be exploited remotely by hosting a specially designed website or by providing a specially crafted document file to execute arbitrary code;
Multiple vulnerabilities related to an incorrect validating guest operating system user input in Windows Hyper-V can be exploited locally by running a specially designed application on a guest operating system to execute arbitrary code or to cause a denial of service;
An incorrect handling of connection requests in Remote Desktop Protocol (RDP) can be exploited remotely by running a specially designed application against a server that provides RDP services to cause a denial of service;
Multiple vulnerabilities related to an incorrect handling of objects in memory in Volume Manager Extension Driver and win32k component can be exploited locally by logging on to an affected system and running a specially designed application to obtain sensitive information;
An improper handling of objects and file executing way in Windows Error Reporting (WER) can be exploited locally via a specially designed application to gain privileges;
Multiple vulnerabilities related to an incorrect handling of objects in memory in Windows Subsystem for Linux and Windows Common Log File System can be exploited locally via a specially designed application to cause a denial of service against the local system;
An incorrect handling of NT pipes in memory of Windows Subsystem for Linux can be exploited locally by running a specially designed application to gain privileges;
An incorrect handling of objects in Win32k can be exploited locally by logging on to an affected system and running a specially designed application to execute arbitrary code in kernel mode;
An improper handling of parameters in a method of a DCOM class in Windows Input Method Editor (IME) can be exploited locally by running a specially designed application to execute arbitrary code;
An improper handling of objects in memory in Microsoft Windows PDF Library can be exploited remotely via a specially designed website that contains malicious PDF content to execute arbitrary code;
An incorrect handling of object in Microsoft JET Database Engine can be exploited remotely by sending a specially designed database file via email and convincing a user to open it to execute arbitrary code;
An incorrect handling of objects in memory in Windows Search can be exploited remotely by sending specially designed messages to the Windows Search service to execute arbitrary code;
An improper handling of objects in memory in Win32k component can be exploited locally via a specially designed application to gain privileges;
An improper NETBIOS packets handling in the Windows network stack can be exploited remotely by sending a series of TCP packets to a target system to cause denial of service.

Technical detailsVulnerability (9) can be exploited even if IME is not enabled.

On Windows 10, vulnerability (10) can be exploited via a specially designed website containing malicious PDF content. As for other operating systems, malicious users have to convince users to open a specially designed PDF document in browser by sending them a link in an email, instant message or as an email attachment.

Ursprüngliche Informationshinweise

CVE Liste

CVE-2017-8593
critical
CVE-2017-8591
critical
CVE-2017-8620
critical
CVE-2017-8664
critical
CVE-2017-8691
critical
CVE-2017-0250
critical
CVE-2017-8633
critical
CVE-2017-8623
critical
CVE-2017-8622
critical
CVE-2017-8668
critical
CVE-2017-8627
critical
CVE-2017-0293
critical
CVE-2017-0174
critical
CVE-2017-8666
critical
CVE-2017-8673
critical
CVE-2017-8624
critical

KB Liste

Mehr erfahren

Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken statistics.securelist.com

Sie haben einen Fehler in der Beschreibung der Schwachstelle gefunden? Mitteilen!