Kaspersky Threats

Detect date

?

01/03/2018

Severity

?

Critical

Description

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious user can exploit these vulnerabilities to cause denial of service, privilege escalation and obtain sensitive information. Below is a complete list of vulnerabilities:

Improper handling objects in memory in Windows Adobe Type Manager Font Driver (ATMFD.dll) can be exploited locally to gain privileges;
Improper handling objects in memory in Windows Adobe Type Manager Font Driver (ATMFD.dll) can be exploited locally to obtain sensitive information;
Windows IPSec vulnerability can be exploited remotely to cause denial of service;
Multiple elevation of privilege vulnerabilities in the way that the Windows Kernel API enforces permissions can be exploited locally to gain privileges;
A Win32k information disclosure vulnerability in the Windows GDI component can be exploited locally to obtain sensitive information;
A vulnerability in the Microsoft Server Message Block can be exploited locally to gain privileges;
Multiple information disclosure vulnerabilities in the Windows kernel can be exploited locally to obtain sensitive information;
Improper handling objects in memory in the Windows kernel can be exploited locally to gain privileges;
An integer overflow in Windows Subsystem for Linux can be exploited locally to gain privileges;
Improper handling objects in memory in the Color Management Module (ICM32.dll) can be exploited locally to obtain sensitive information;

All Kaspersky Lab business and consumer products are compatible with the update. Our database update on 28th December enables the compatibility flag, recommended by Microsoft, to allow devices to apply the update from 3rd January.Further details of Kaspersky Lab compatibility with Microsoft security updates are on our Support page.Our recommendation remains that for optimum protection against vulnerabilities, software and operating system updates should be installed as soon as possible.More about the CPU vulnerabilities can be found on the Kaspersky Lab blog here and on the announcement website here.

Affected products

Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2012 R2 (Server Core installation)
Windows 10 Version 1511 for 32-bit Systems
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows 10 Version 1511 for x64-based Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 7 for x64-based Systems Service Pack 1
Windows 10 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012 R2
Windows 10 for 32-bit Systems
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows 10 Version 1703 for x64-based Systems
Windows 10 Version 1703 for 32-bit Systems
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for 64-based Systems
Windows Server, version 1709 (Server Core Installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel). In addition, you may also need to install firmware updates from manufacturer of your device for increased protection. Check for relevant updates with manufacturer of your device.

Original advisories

ADV180002
CVE-2018-0741
CVE-2018-0743
CVE-2018-0744
CVE-2018-0745
CVE-2018-0746
CVE-2018-0747
CVE-2018-0748
CVE-2018-0749
CVE-2018-0750
CVE-2018-0751
CVE-2018-0752
CVE-2018-0753
CVE-2018-0754
CVE-2018-0788

Impacts

?

OSI

[?]

DoS

[?]

PE

[?]

Detect date ?	01/03/2018
Severity ?	Critical
Description	Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious user can exploit these vulnerabilities to cause denial of service, privilege escalation and obtain sensitive information. Below is a complete list of vulnerabilities: Improper handling objects in memory in Windows Adobe Type Manager Font Driver (ATMFD.dll) can be exploited locally to gain privileges; Improper handling objects in memory in Windows Adobe Type Manager Font Driver (ATMFD.dll) can be exploited locally to obtain sensitive information; Windows IPSec vulnerability can be exploited remotely to cause denial of service; Multiple elevation of privilege vulnerabilities in the way that the Windows Kernel API enforces permissions can be exploited locally to gain privileges; A Win32k information disclosure vulnerability in the Windows GDI component can be exploited locally to obtain sensitive information; A vulnerability in the Microsoft Server Message Block can be exploited locally to gain privileges; Multiple information disclosure vulnerabilities in the Windows kernel can be exploited locally to obtain sensitive information; Improper handling objects in memory in the Windows kernel can be exploited locally to gain privileges; An integer overflow in Windows Subsystem for Linux can be exploited locally to gain privileges; Improper handling objects in memory in the Color Management Module (ICM32.dll) can be exploited locally to obtain sensitive information; All Kaspersky Lab business and consumer products are compatible with the update. Our database update on 28th December enables the compatibility flag, recommended by Microsoft, to allow devices to apply the update from 3rd January.Further details of Kaspersky Lab compatibility with Microsoft security updates are on our Support page.Our recommendation remains that for optimum protection against vulnerabilities, software and operating system updates should be installed as soon as possible.More about the CPU vulnerabilities can be found on the Kaspersky Lab blog here and on the announcement website here.
Affected products	Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2012 R2 (Server Core installation) Windows 10 Version 1511 for 32-bit Systems Windows 8.1 for 32-bit systems Windows 8.1 for x64-based systems Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 Windows 10 Version 1511 for x64-based Systems Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 7 for x64-based Systems Service Pack 1 Windows 10 for x64-based Systems Windows 7 for 32-bit Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2012 R2 Windows 10 for 32-bit Systems Windows Server 2016 Windows Server 2016 (Server Core installation) Windows 10 Version 1703 for x64-based Systems Windows 10 Version 1703 for 32-bit Systems Windows 10 Version 1709 for 32-bit Systems Windows 10 Version 1709 for 64-based Systems Windows Server, version 1709 (Server Core Installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for Itanium-Based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2012 Windows Server 2012 (Server Core installation)
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel). In addition, you may also need to install firmware updates from manufacturer of your device for increased protection. Check for relevant updates with manufacturer of your device.
Original advisories	ADV180002 CVE-2018-0741 CVE-2018-0743 CVE-2018-0744 CVE-2018-0745 CVE-2018-0746 CVE-2018-0747 CVE-2018-0748 CVE-2018-0749 CVE-2018-0750 CVE-2018-0751 CVE-2018-0752 CVE-2018-0753 CVE-2018-0754 CVE-2018-0788
Impacts ?	OSI [?] DoS [?] PE [?]
Related products	Microsoft Windows
CVE-IDS ?	CVE-2018-07410.0Unknown CVE-2018-07430.0Unknown CVE-2018-07440.0Unknown CVE-2018-07450.0Unknown CVE-2018-07460.0Unknown CVE-2018-07470.0Unknown CVE-2018-07480.0Unknown CVE-2018-07490.0Unknown CVE-2018-07500.0Unknown CVE-2018-07510.0Unknown CVE-2018-07520.0Unknown CVE-2018-07530.0Unknown CVE-2018-07540.0Unknown CVE-2018-07880.0Unknown
Microsoft official advisories	Microsoft Security Update Guide
KB list	4093112 4056894 4056897 4056898 4056888 4056890 4056893 4056891 4056892 4056942 4056896 4056899 4056613 4056615 4056759 4056944 4056941 4074591 4056895 4074590 4103723 4284860 4284874 4338830 4338820 4340583 4338816 4338831 4345424 4345425 4467708 4493464 4493472 4493467 4493446 4493448
Exploitation	The following public exploits exists for this vulnerability: https://www.exploit-db.com/exploits/43962 https://www.exploit-db.com/exploits/43446 https://www.exploit-db.com/exploits/43470 https://www.exploit-db.com/exploits/43471 https://www.exploit-db.com/exploits/43514 https://www.exploit-db.com/exploits/43517 https://www.exploit-db.com/exploits/43515 https://www.exploit-db.com/exploits/43516 Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.