Kaspersky Threats

Detect date

?

05/08/2018

Severity

?

Critical

Description

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, bypass security restrictions, execute arbitrary code.

Below is a complete list of vulnerabilities:

An elevation of privilege vulnerability in Windows Common Log File System Driver can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Win32k can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in DirectX Graphics Kernel can be exploited remotely via specially crafted application to gain privileges.
An elevation of privilege vulnerability in Windows Kernel can be exploited remotely via specially crafted application to gain privileges.
An information disclosure vulnerability in Windows Kernel can be exploited remotely via specially crafted application to obtain sensitive information.
A security feature bypass vulnerability in Windows can be exploited remotely to bypass security restrictions.
A remote code execution vulnerability in Hyper-V vSMB can be exploited remotely via specially crafted application to execute arbitrary code.
A remote code execution vulnerability in Microsoft COM for Windows can be exploited remotely via specially crafted file to execute arbitrary code.
An elevation of privilege vulnerability in Windows Image can be exploited remotely via specially crafted application to gain privileges.
A remote code execution vulnerability in Windows VBScript Engine can be exploited remotely via specially crafted website to execute arbitrary code.
An elevation of privilege vulnerability in Windows can be exploited remotely via specially crafted application to gain privileges.
A remote code execution vulnerability in Windows can be exploited remotely via specially crafted document to execute arbitrary code.
A remote code execution vulnerability in Windows Hyper-V can be exploited remotely via specially crafted application to execute arbitrary code.

Affected products

Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1703 for 32-bit Systems
Windows 10 Version 1703 for x64-based Systems
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)
Windows Server 2016
Windows Server, version 1803 (Server Core Installation)
Windows Server 2016 (Server Core installation)
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1511 for 32-bit Systems
Windows 10 Version 1511 for x64-based Systems

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

CVE-2018-8167
CVE-2018-8166
CVE-2018-8165
CVE-2018-8164
CVE-2018-8897
CVE-2018-8141
CVE-2018-8129
CVE-2018-8142
CVE-2018-8127
CVE-2018-8124
CVE-2018-0961
CVE-2018-0824
CVE-2018-8170
CVE-2018-8174
CVE-2018-8134
CVE-2018-8136
CVE-2018-8132
CVE-2018-0854
CVE-2018-0958
CVE-2018-0959

Impacts

?

ACE

[?]

OSI

[?]

SB

[?]

PE

[?]

Detect date ?	05/08/2018
Severity ?	Critical
Description	Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: An elevation of privilege vulnerability in Windows Common Log File System Driver can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Win32k can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in DirectX Graphics Kernel can be exploited remotely via specially crafted application to gain privileges. An elevation of privilege vulnerability in Windows Kernel can be exploited remotely via specially crafted application to gain privileges. An information disclosure vulnerability in Windows Kernel can be exploited remotely via specially crafted application to obtain sensitive information. A security feature bypass vulnerability in Windows can be exploited remotely to bypass security restrictions. A remote code execution vulnerability in Hyper-V vSMB can be exploited remotely via specially crafted application to execute arbitrary code. A remote code execution vulnerability in Microsoft COM for Windows can be exploited remotely via specially crafted file to execute arbitrary code. An elevation of privilege vulnerability in Windows Image can be exploited remotely via specially crafted application to gain privileges. A remote code execution vulnerability in Windows VBScript Engine can be exploited remotely via specially crafted website to execute arbitrary code. An elevation of privilege vulnerability in Windows can be exploited remotely via specially crafted application to gain privileges. A remote code execution vulnerability in Windows can be exploited remotely via specially crafted document to execute arbitrary code. A remote code execution vulnerability in Windows Hyper-V can be exploited remotely via specially crafted application to execute arbitrary code.
Affected products	Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1703 for 32-bit Systems Windows 10 Version 1703 for x64-based Systems Windows 10 Version 1709 for 32-bit Systems Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 1803 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 for x64-based Systems Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems Service Pack 1 Windows 8.1 for 32-bit systems Windows 8.1 for x64-based systems Windows RT 8.1 Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for Itanium-Based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2012 Windows Server 2012 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2016 Windows Server, version 1803 (Server Core Installation) Windows Server 2016 (Server Core installation) Windows 10 Version 1709 for x64-based Systems Windows 10 Version 1511 for 32-bit Systems Windows 10 Version 1511 for x64-based Systems
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories	CVE-2018-8167 CVE-2018-8166 CVE-2018-8165 CVE-2018-8164 CVE-2018-8897 CVE-2018-8141 CVE-2018-8129 CVE-2018-8142 CVE-2018-8127 CVE-2018-8124 CVE-2018-0961 CVE-2018-0824 CVE-2018-8170 CVE-2018-8174 CVE-2018-8134 CVE-2018-8136 CVE-2018-8132 CVE-2018-0854 CVE-2018-0958 CVE-2018-0959
Impacts ?	ACE [?] OSI [?] SB [?] PE [?]
Related products	Microsoft Windows Server 2012 Microsoft Windows 8 Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows 10
CVE-IDS ?	CVE-2018-81670.0Unknown CVE-2018-81660.0Unknown CVE-2018-81650.0Unknown CVE-2018-81640.0Unknown CVE-2018-88970.0Unknown CVE-2018-81410.0Unknown CVE-2018-81290.0Unknown CVE-2018-81420.0Unknown CVE-2018-81270.0Unknown CVE-2018-81240.0Unknown CVE-2018-09610.0Unknown CVE-2018-08240.0Unknown CVE-2018-81700.0Unknown CVE-2018-81740.0Unknown CVE-2018-81340.0Unknown CVE-2018-81360.0Unknown CVE-2018-81320.0Unknown CVE-2018-08540.0Unknown CVE-2018-09580.0Unknown CVE-2018-09590.0Unknown
Microsoft official advisories	Microsoft Security Update Guide
KB list	4093112 4103723 4103716 4103731 4103715 4103721 4103730 4103726 4103727 4103725 4093107 4093119 4103728
Exploitation	The following public exploits exists for this vulnerability: https://www.exploit-db.com/exploits/45024 https://www.exploit-db.com/exploits/44697 https://www.exploit-db.com/exploits/44906 https://www.exploit-db.com/exploits/44741 https://www.exploit-db.com/exploits/44630 Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.