{"id": "CVE-2018-8122", "bulletinFamily": "NVD", "title": "CVE-2018-8122", "description": "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka \"Scripting Engine Memory Corruption Vulnerability.\" This affects Internet Explorer 11. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8128, CVE-2018-8137, CVE-2018-8139.", "published": "2018-05-09T19:29:00", "modified": "2020-08-24T17:37:00", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-8122", "reporter": "cve@mitre.org", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8122", "http://www.securitytracker.com/id/1040846", "http://www.securityfocus.com/bid/103995"], "cvelist": ["CVE-2018-8122"], "type": "cve", "lastseen": "2021-02-02T06:52:42", "edition": 5, "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "symantec", "idList": ["SMNTC-103995"]}, {"type": "nessus", "idList": ["SMB_NT_MS18_MAY_4103731.NASL", "SMB_NT_MS18_MAY_4103718.NASL", "SMB_NT_MS18_MAY_4103725.NASL", "SMB_NT_MS18_MAY_4103716.NASL", "SMB_NT_MS18_MAY_4103727.NASL", "SMB_NT_MS18_MAY_4103723.NASL", "SMB_NT_MS18_MAY_INTERNET_EXPLORER.NASL", "SMB_NT_MS18_MAY_4103721.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310813339", "OPENVAS:1361412562310813340", "OPENVAS:1361412562310813342", "OPENVAS:1361412562310813338", "OPENVAS:1361412562310813336", "OPENVAS:1361412562310813346", "OPENVAS:1361412562310813341"]}, {"type": "kaspersky", "idList": ["KLA11247"]}, {"type": "trendmicroblog", "idList": ["TRENDMICROBLOG:0CB92F2EE8EC7EB60BEEAFE3A0B1926F"]}, {"type": "talosblog", "idList": ["TALOSBLOG:C19AB95C902B2507E8156BE7B09BE73B"]}], "modified": "2021-02-02T06:52:42", "rev": 2}, "score": {"value": 6.6, "vector": "NONE", "modified": "2021-02-02T06:52:42", "rev": 2}, "vulnersScore": 6.6}, "cpe": ["cpe:/a:microsoft:internet_explorer:11"], "affectedSoftware": [{"cpeName": "microsoft:internet_explorer", "name": "microsoft internet explorer", "operator": "eq", "version": "11"}], "cvss2": {"cvssV2": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.6, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.6, "impactScore": 5.9}, "cpe23": ["cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*"], "cwe": ["CWE-787"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "103995", "refsource": "BID", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/103995"}, {"name": "1040846", "refsource": "SECTRACK", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1040846"}, {"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8122", "refsource": "CONFIRM", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8122"}]}

{"symantec": [{"lastseen": "2018-05-08T21:56:24", "bulletinFamily": "software", "cvelist": ["CVE-2018-8122"], "description": "### Description\n\nMicrosoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions.\n\n### Technologies Affected\n\n * Microsoft Internet Explorer 11 \n\n### Recommendations\n\n**Run all software as a nonprivileged user with minimal access rights.** \nTo reduce the impact of latent vulnerabilities, always run nonadministrative software as an unprivileged user with minimal access rights.\n\n**Deploy network intrusion detection systems to monitor network traffic for malicious activity.** \nDeploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This includes but is not limited to requests that include NOP sleds and unexplained incoming and outgoing traffic. This may indicate exploit attempts or activity that results from successful exploits\n\n**Do not follow links provided by unknown or untrusted sources.** \nWeb users should be cautious about following links to sites that are provided by unfamiliar or suspicious sources. Filtering HTML from emails may help remove a possible vector for transmitting malicious links to users.\n\n**Implement multiple redundant layers of security.** \nMemory-protection schemes (such as nonexecutable stack and heap configurations and randomly mapped memory segments) will complicate exploits of memory-corruption vulnerabilities.\n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "modified": "2018-05-08T00:00:00", "published": "2018-05-08T00:00:00", "id": "SMNTC-103995", "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/103995", "type": "symantec", "title": "Microsoft Internet Explorer Scripting Engine CVE-2018-8122 Remote Memory Corruption Vulnerability", "cvss": {"score": 0.0, "vector": "NONE"}}], "nessus": [{"lastseen": "2021-02-01T06:17:04", "description": "The Internet Explorer installation on the remote host is\nmissing security updates. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)", "edition": 26, "cvss3": {"score": 7.5, "vector": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2018-05-08T00:00:00", "title": "Security Updates for Internet Explorer (May 2018)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-8178", "CVE-2018-0955", "CVE-2018-0954", "CVE-2018-8145", "CVE-2018-8122", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-1025"], "modified": "2021-02-02T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS18_MAY_INTERNET_EXPLORER.NASL", "href": "https://www.tenable.com/plugins/nessus/109613", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109613);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/04/05 23:25:09\");\n\n script_cve_id(\n \"CVE-2018-0954\",\n \"CVE-2018-0955\",\n \"CVE-2018-1022\",\n \"CVE-2018-1025\",\n \"CVE-2018-8114\",\n \"CVE-2018-8122\",\n \"CVE-2018-8145\",\n \"CVE-2018-8178\"\n );\n script_xref(name:\"MSKB\", value:\"4103730\");\n script_xref(name:\"MSKB\", value:\"4103768\");\n script_xref(name:\"MSKB\", value:\"4103718\");\n script_xref(name:\"MSKB\", value:\"4103725\");\n script_xref(name:\"MSFT\", value:\"MS18-4103730\");\n script_xref(name:\"MSFT\", value:\"MS18-4103768\");\n script_xref(name:\"MSFT\", value:\"MS18-4103718\");\n script_xref(name:\"MSFT\", value:\"MS18-4103725\");\n\n script_name(english:\"Security Updates for Internet Explorer (May 2018)\");\n script_summary(english:\"Checks for Microsoft security updates.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Internet Explorer installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Internet Explorer installation on the remote host is\nmissing security updates. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\");\n # https://support.microsoft.com/en-us/help/4103730/windows-server-2012-update-kb4103730\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?a47bd1fd\");\n # https://support.microsoft.com/en-us/help/4103768/cumulative-security-update-for-internet-explorer\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e92a132a\");\n # https://support.microsoft.com/en-us/help/4103718/windows-7-update-kb4103718\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?9cd8d3d4\");\n # https://support.microsoft.com/en-us/help/4103725/windows-81-update-kb4103725\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?dba0079e\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released the following security updates to address this issue: \n -KB4103730\n -KB4103768\n -KB4103718\n -KB4103725\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS18-05';\nkbs = make_list(\n '4103730',\n '4103725',\n '4103718',\n '4103768'\n);\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nos = get_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(vista:'2', win7:'1', win8:'0', win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nproductname = get_kb_item_or_exit(\"SMB/ProductName\", exit_code:1);\nif (\"Windows 8\" >< productname && \"8.1\" >!< productname)\n audit(AUDIT_OS_SP_NOT_VULN);\nif (\"Vista\" >< productname) audit(AUDIT_OS_SP_NOT_VULN);\n\nif (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n # Windows 8.1 / Windows Server 2012 R2\n # Internet Explorer 11\n hotfix_is_vulnerable(os:\"6.3\", sp:0, file:\"mshtml.dll\", version:\"11.0.9600.19002\", min_version:\"11.0.9600.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"4103768\") ||\n\n # Windows Server 2012\n # Internet Explorer 10\n hotfix_is_vulnerable(os:\"6.2\", sp:0, file:\"mshtml.dll\", version:\"10.0.9200.22434\", min_version:\"10.0.9200.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"4103768\") ||\n\n # Windows 7 / Server 2008 R2\n # Internet Explorer 11\n hotfix_is_vulnerable(os:\"6.1\", sp:1, file:\"mshtml.dll\", version:\"11.0.9600.19002\", min_version:\"11.0.9600.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"4103768\") ||\n\n # Windows Server 2008\n # Internet Explorer 9\n hotfix_is_vulnerable(os:\"6.0\", sp:2, file:\"mshtml.dll\", version:\"9.0.8112.21219\", min_version:\"9.0.8112.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"4103768\")\n)\n{\n report = '\\nNote: The fix for this issue is available in either of the following updates:\\n';\n report += ' - KB4103768 : Cumulative Security Update for Internet Explorer\\n';\n if(os == \"6.3\")\n {\n report += ' - KB4103725 : Windows 8.1 / Server 2012 R2 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS18-05', kb:'4103725', report);\n }\n else if(os == \"6.2\")\n {\n report += ' - KB4103730 : Windows Server 2012 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS18-05', kb:'4103730', report);\n }\n else if(os == \"6.1\")\n {\n report += ' - KB4103718 : Windows 7 / Server 2008 R2 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS18-05', kb:'4103718', report);\n }\n set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-02-01T06:16:57", "description": "The remote Windows host is missing security update 4103712\nor cumulative update 4103718. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8120, CVE-2018-8124,\n CVE-2018-8164, CVE-2018-8166)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)", "edition": 31, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2018-05-08T00:00:00", "title": "KB4103712: Windows 7 and Windows Server 2008 R2 May 2018 Security Update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-8136", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-0955", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8124", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8897", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-8120", "CVE-2018-1025"], "modified": "2021-02-02T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS18_MAY_4103718.NASL", "href": "https://www.tenable.com/plugins/nessus/109604", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109604);\n script_version(\"1.10\");\n script_cvs_date(\"Date: 2019/11/08\");\n\n script_cve_id(\n \"CVE-2018-0765\",\n \"CVE-2018-0824\",\n \"CVE-2018-0954\",\n \"CVE-2018-0955\",\n \"CVE-2018-0959\",\n \"CVE-2018-1022\",\n \"CVE-2018-1025\",\n \"CVE-2018-1039\",\n \"CVE-2018-8114\",\n \"CVE-2018-8120\",\n \"CVE-2018-8122\",\n \"CVE-2018-8124\",\n \"CVE-2018-8127\",\n \"CVE-2018-8136\",\n \"CVE-2018-8145\",\n \"CVE-2018-8164\",\n \"CVE-2018-8166\",\n \"CVE-2018-8167\",\n \"CVE-2018-8174\",\n \"CVE-2018-8178\",\n \"CVE-2018-8897\"\n );\n script_xref(name:\"MSKB\", value:\"4103718\");\n script_xref(name:\"MSKB\", value:\"4103712\");\n script_xref(name:\"MSFT\", value:\"MS18-4103718\");\n script_xref(name:\"MSFT\", value:\"MS18-4103712\");\n\n script_name(english:\"KB4103712: Windows 7 and Windows Server 2008 R2 May 2018 Security Update\");\n script_summary(english:\"Checks for rollup.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4103712\nor cumulative update 4103718. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8120, CVE-2018-8124,\n CVE-2018-8164, CVE-2018-8166)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\");\n # https://support.microsoft.com/en-us/help/4103718/windows-7-update-kb4103718\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?9cd8d3d4\");\n # https://support.microsoft.com/en-us/help/4103712/windows-7-update-kb4103712\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0cbb798a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Only update KB4103712 or Cumulative Update KB4103718.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-8136\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS18-05\";\nkbs = make_list('4103718', '4103712');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win7:'1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"6.1\",\n sp:1,\n rollup_date:\"05_2018\",\n bulletin:bulletin,\n rollup_kb_list:[4103718, 4103712])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-02-01T06:17:01", "description": "The remote Windows host is missing security update 4103715\nor cumulative update 4103725. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)", "edition": 31, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2018-05-08T00:00:00", "title": "KB4103715: Windows 8.1 and Windows Server 2012 R2 May 2018 Security Update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-8134", "CVE-2018-8136", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-0955", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8124", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8897", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-1025"], "modified": "2021-02-02T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS18_MAY_4103725.NASL", "href": "https://www.tenable.com/plugins/nessus/109607", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109607);\n script_version(\"1.10\");\n script_cvs_date(\"Date: 2019/11/08\");\n\n script_cve_id(\n \"CVE-2018-0765\",\n \"CVE-2018-0824\",\n \"CVE-2018-0954\",\n \"CVE-2018-0955\",\n \"CVE-2018-0959\",\n \"CVE-2018-1022\",\n \"CVE-2018-1025\",\n \"CVE-2018-1039\",\n \"CVE-2018-8114\",\n \"CVE-2018-8122\",\n \"CVE-2018-8124\",\n \"CVE-2018-8127\",\n \"CVE-2018-8134\",\n \"CVE-2018-8136\",\n \"CVE-2018-8145\",\n \"CVE-2018-8164\",\n \"CVE-2018-8166\",\n \"CVE-2018-8167\",\n \"CVE-2018-8174\",\n \"CVE-2018-8178\",\n \"CVE-2018-8897\"\n );\n script_xref(name:\"MSKB\", value:\"4103715\");\n script_xref(name:\"MSKB\", value:\"4103725\");\n script_xref(name:\"MSFT\", value:\"MS18-4103715\");\n script_xref(name:\"MSFT\", value:\"MS18-4103725\");\n\n script_name(english:\"KB4103715: Windows 8.1 and Windows Server 2012 R2 May 2018 Security Update\");\n script_summary(english:\"Checks for rollup.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4103715\nor cumulative update 4103725. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\");\n # https://support.microsoft.com/en-us/help/4103715/windows-81-update-kb4103715\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?781c2262\");\n # https://support.microsoft.com/en-us/help/4103725/windows-81-update-kb4103725\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?dba0079e\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Only update KB4103715 or Cumulative Update KB4103725.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-8136\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS18-05\";\nkbs = make_list('4103715', '4103725');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\n# Windows 8 EOL\nproductname = get_kb_item_or_exit(\"SMB/ProductName\", exit_code:1);\nif (\"Windows 8\" >< productname && \"8.1\" >!< productname)\n audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"6.3\",\n sp:0,\n rollup_date:\"05_2018\",\n bulletin:bulletin,\n rollup_kb_list:[4103715, 4103725])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-08-19T05:13:18", "description": "The remote Windows host is missing security update 4103716.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A security feature bypass vulnerability exists in\n Windows which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-0958,\n CVE-2018-8129, CVE-2018-8132)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Microsoft Edge. The vulnerability could corrupt memory\n in such a way that an attacker could execute arbitrary\n code in the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-0953,\n CVE-2018-8137)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A security feature bypass vulnerability exists when\n Microsoft Edge improperly handles requests of different\n origins. The vulnerability allows Microsoft Edge to\n bypass Same-Origin Policy (SOP) restrictions, and to\n allow requests that should otherwise be ignored. An\n attacker who successfully exploited the vulnerability\n could force the browser to send data that would\n otherwise be restricted. (CVE-2018-8112)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A security feature bypass vulnerability exists in\n Windows Scripting Host which could allow an attacker to\n bypass Device Guard. An attacker who successfully\n exploited this vulnerability could circumvent a User\n Mode Code Integrity (UMCI) policy on the machine.\n (CVE-2018-0854)\n\n - An elevation of privilege vulnerability exists when the\n DirectX Graphics Kernel (DXGKRNL) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8165)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - A security feature bypass vulnerability exists when\n Internet Explorer fails to validate User Mode Code\n Integrity (UMCI) policies. The vulnerability could allow\n an attacker to bypass Device Guard UMCI policies.\n (CVE-2018-8126)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A remote code execution vulnerability exists when\n Microsoft Edge improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8179)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge. The vulnerability could\n corrupt memory in such a way that an attacker could\n execute arbitrary code in the context of the current\n user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2018-0943, CVE-2018-8133)", "edition": 27, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2018-05-08T00:00:00", "title": "KB4103716: Windows 10 May 2018 Security Update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-8134", "CVE-2018-0854", "CVE-2018-8136", "CVE-2018-8126", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-8132", "CVE-2018-0955", "CVE-2018-8179", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8165", "CVE-2018-0953", "CVE-2018-8124", "CVE-2018-8112", "CVE-2018-8133", "CVE-2018-0958", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8897", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2018-8129", "CVE-2018-8137", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-0943", "CVE-2018-1025"], "modified": "2018-05-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS18_MAY_4103716.NASL", "href": "https://www.tenable.com/plugins/nessus/109603", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109603);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/08/18\");\n\n script_cve_id(\n \"CVE-2018-0765\",\n \"CVE-2018-0824\",\n \"CVE-2018-0854\",\n \"CVE-2018-0943\",\n \"CVE-2018-0953\",\n \"CVE-2018-0954\",\n \"CVE-2018-0955\",\n \"CVE-2018-0958\",\n \"CVE-2018-0959\",\n \"CVE-2018-1022\",\n \"CVE-2018-1025\",\n \"CVE-2018-1039\",\n \"CVE-2018-8112\",\n \"CVE-2018-8114\",\n \"CVE-2018-8122\",\n \"CVE-2018-8124\",\n \"CVE-2018-8126\",\n \"CVE-2018-8127\",\n \"CVE-2018-8129\",\n \"CVE-2018-8132\",\n \"CVE-2018-8133\",\n \"CVE-2018-8134\",\n \"CVE-2018-8136\",\n \"CVE-2018-8137\",\n \"CVE-2018-8145\",\n \"CVE-2018-8164\",\n \"CVE-2018-8165\",\n \"CVE-2018-8166\",\n \"CVE-2018-8167\",\n \"CVE-2018-8174\",\n \"CVE-2018-8178\",\n \"CVE-2018-8179\",\n \"CVE-2018-8897\"\n );\n script_xref(name:\"MSKB\", value:\"4103716\");\n script_xref(name:\"MSFT\", value:\"MS18-4103716\");\n\n script_name(english:\"KB4103716: Windows 10 May 2018 Security Update\");\n script_summary(english:\"Checks for rollup.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4103716.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A security feature bypass vulnerability exists in\n Windows which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-0958,\n CVE-2018-8129, CVE-2018-8132)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Microsoft Edge. The vulnerability could corrupt memory\n in such a way that an attacker could execute arbitrary\n code in the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-0953,\n CVE-2018-8137)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A security feature bypass vulnerability exists when\n Microsoft Edge improperly handles requests of different\n origins. The vulnerability allows Microsoft Edge to\n bypass Same-Origin Policy (SOP) restrictions, and to\n allow requests that should otherwise be ignored. An\n attacker who successfully exploited the vulnerability\n could force the browser to send data that would\n otherwise be restricted. (CVE-2018-8112)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A security feature bypass vulnerability exists in\n Windows Scripting Host which could allow an attacker to\n bypass Device Guard. An attacker who successfully\n exploited this vulnerability could circumvent a User\n Mode Code Integrity (UMCI) policy on the machine.\n (CVE-2018-0854)\n\n - An elevation of privilege vulnerability exists when the\n DirectX Graphics Kernel (DXGKRNL) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8165)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - A security feature bypass vulnerability exists when\n Internet Explorer fails to validate User Mode Code\n Integrity (UMCI) policies. The vulnerability could allow\n an attacker to bypass Device Guard UMCI policies.\n (CVE-2018-8126)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A remote code execution vulnerability exists when\n Microsoft Edge improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8179)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge. The vulnerability could\n corrupt memory in such a way that an attacker could\n execute arbitrary code in the context of the current\n user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2018-0943, CVE-2018-8133)\");\n # https://support.microsoft.com/en-us/help/4103716/windows-10-update-kb4103716\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?fb504ab5\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB4103716.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-8136\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS18-05\";\nkbs = make_list('4103716');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"10240\",\n rollup_date:\"05_2018\",\n bulletin:bulletin,\n rollup_kb_list:[4103716])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-08-19T05:13:19", "description": "The remote Windows host is missing security update 4103723.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Microsoft Edge. The vulnerability could corrupt memory\n in such a way that an attacker could execute arbitrary\n code in the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-0951,\n CVE-2018-0953, CVE-2018-8137)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate vSMB packet data. An attacker who successfully\n exploited these vulnerabilities could execute arbitrary\n code on a target operating system. To exploit these\n vulnerabilities, an attacker running inside a virtual\n machine could run a specially crafted application that\n could cause the Hyper-V host operating system to execute\n arbitrary code. The update addresses the vulnerabilities\n by correcting how Windows Hyper-V validates vSMB packet\n data. (CVE-2018-0961)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A security feature bypass vulnerability exists in\n Windows which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-0958,\n CVE-2018-8129, CVE-2018-8132)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A security feature bypass vulnerability exists when\n Microsoft Edge improperly handles requests of different\n origins. The vulnerability allows Microsoft Edge to\n bypass Same-Origin Policy (SOP) restrictions, and to\n allow requests that should otherwise be ignored. An\n attacker who successfully exploited the vulnerability\n could force the browser to send data that would\n otherwise be restricted. (CVE-2018-8112)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A security feature bypass vulnerability exists in\n Windows Scripting Host which could allow an attacker to\n bypass Device Guard. An attacker who successfully\n exploited this vulnerability could circumvent a User\n Mode Code Integrity (UMCI) policy on the machine.\n (CVE-2018-0854)\n\n - An elevation of privilege vulnerability exists when the\n DirectX Graphics Kernel (DXGKRNL) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8165)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - A security feature bypass vulnerability exists when\n Internet Explorer fails to validate User Mode Code\n Integrity (UMCI) policies. The vulnerability could allow\n an attacker to bypass Device Guard UMCI policies.\n (CVE-2018-8126)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A remote code execution vulnerability exists when\n Microsoft Edge improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8179)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge. The vulnerability could\n corrupt memory in such a way that an attacker could\n execute arbitrary code in the context of the current\n user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2018-0943, CVE-2018-8133)", "edition": 27, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2018-05-08T00:00:00", "title": "KB4103723: Windows 10 Version 1607 and Windows Server 2016 May 2018 Security Update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-8134", "CVE-2018-0961", "CVE-2018-0854", "CVE-2018-8136", "CVE-2018-8126", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-8132", "CVE-2018-0955", "CVE-2018-8179", "CVE-2018-0951", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8165", "CVE-2018-0953", "CVE-2018-8124", "CVE-2018-8112", "CVE-2018-8133", "CVE-2018-0958", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8897", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2018-8129", "CVE-2018-8137", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-0943", "CVE-2018-1025"], "modified": "2018-05-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS18_MAY_4103723.NASL", "href": "https://www.tenable.com/plugins/nessus/109606", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109606);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/08/18\");\n\n script_cve_id(\n \"CVE-2018-0765\",\n \"CVE-2018-0824\",\n \"CVE-2018-0854\",\n \"CVE-2018-0943\",\n \"CVE-2018-0951\",\n \"CVE-2018-0953\",\n \"CVE-2018-0954\",\n \"CVE-2018-0955\",\n \"CVE-2018-0958\",\n \"CVE-2018-0959\",\n \"CVE-2018-0961\",\n \"CVE-2018-1022\",\n \"CVE-2018-1025\",\n \"CVE-2018-1039\",\n \"CVE-2018-8112\",\n \"CVE-2018-8114\",\n \"CVE-2018-8122\",\n \"CVE-2018-8124\",\n \"CVE-2018-8126\",\n \"CVE-2018-8127\",\n \"CVE-2018-8129\",\n \"CVE-2018-8132\",\n \"CVE-2018-8133\",\n \"CVE-2018-8134\",\n \"CVE-2018-8136\",\n \"CVE-2018-8137\",\n \"CVE-2018-8145\",\n \"CVE-2018-8164\",\n \"CVE-2018-8165\",\n \"CVE-2018-8166\",\n \"CVE-2018-8167\",\n \"CVE-2018-8174\",\n \"CVE-2018-8178\",\n \"CVE-2018-8179\",\n \"CVE-2018-8897\"\n );\n script_xref(name:\"MSKB\", value:\"4103723\");\n script_xref(name:\"MSFT\", value:\"MS18-4103723\");\n\n script_name(english:\"KB4103723: Windows 10 Version 1607 and Windows Server 2016 May 2018 Security Update\");\n script_summary(english:\"Checks for rollup.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4103723.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Microsoft Edge. The vulnerability could corrupt memory\n in such a way that an attacker could execute arbitrary\n code in the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-0951,\n CVE-2018-0953, CVE-2018-8137)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate vSMB packet data. An attacker who successfully\n exploited these vulnerabilities could execute arbitrary\n code on a target operating system. To exploit these\n vulnerabilities, an attacker running inside a virtual\n machine could run a specially crafted application that\n could cause the Hyper-V host operating system to execute\n arbitrary code. The update addresses the vulnerabilities\n by correcting how Windows Hyper-V validates vSMB packet\n data. (CVE-2018-0961)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A security feature bypass vulnerability exists in\n Windows which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-0958,\n CVE-2018-8129, CVE-2018-8132)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A security feature bypass vulnerability exists when\n Microsoft Edge improperly handles requests of different\n origins. The vulnerability allows Microsoft Edge to\n bypass Same-Origin Policy (SOP) restrictions, and to\n allow requests that should otherwise be ignored. An\n attacker who successfully exploited the vulnerability\n could force the browser to send data that would\n otherwise be restricted. (CVE-2018-8112)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A security feature bypass vulnerability exists in\n Windows Scripting Host which could allow an attacker to\n bypass Device Guard. An attacker who successfully\n exploited this vulnerability could circumvent a User\n Mode Code Integrity (UMCI) policy on the machine.\n (CVE-2018-0854)\n\n - An elevation of privilege vulnerability exists when the\n DirectX Graphics Kernel (DXGKRNL) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8165)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - A security feature bypass vulnerability exists when\n Internet Explorer fails to validate User Mode Code\n Integrity (UMCI) policies. The vulnerability could allow\n an attacker to bypass Device Guard UMCI policies.\n (CVE-2018-8126)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A remote code execution vulnerability exists when\n Microsoft Edge improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8179)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge. The vulnerability could\n corrupt memory in such a way that an attacker could\n execute arbitrary code in the context of the current\n user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2018-0943, CVE-2018-8133)\");\n # https://support.microsoft.com/en-us/help/4103723/windows-10-update-kb4103723\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?aca51532\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB4103723.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-8136\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS18-05\";\nkbs = make_list('4103723');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"14393\",\n rollup_date:\"05_2018\",\n bulletin:bulletin,\n rollup_kb_list:[4103723])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-08-19T05:13:20", "description": "The remote Windows host is missing security update 4103731.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate vSMB packet data. An attacker who successfully\n exploited these vulnerabilities could execute arbitrary\n code on a target operating system. To exploit these\n vulnerabilities, an attacker running inside a virtual\n machine could run a specially crafted application that\n could cause the Hyper-V host operating system to execute\n arbitrary code. The update addresses the vulnerabilities\n by correcting how Windows Hyper-V validates vSMB packet\n data. (CVE-2018-0961)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A security feature bypass vulnerability exists in\n Windows which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-0958,\n CVE-2018-8129, CVE-2018-8132)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A security feature bypass vulnerability exists when\n Microsoft Edge improperly handles requests of different\n origins. The vulnerability allows Microsoft Edge to\n bypass Same-Origin Policy (SOP) restrictions, and to\n allow requests that should otherwise be ignored. An\n attacker who successfully exploited the vulnerability\n could force the browser to send data that would\n otherwise be restricted. (CVE-2018-8112)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A security feature bypass vulnerability exists in\n Windows Scripting Host which could allow an attacker to\n bypass Device Guard. An attacker who successfully\n exploited this vulnerability could circumvent a User\n Mode Code Integrity (UMCI) policy on the machine.\n (CVE-2018-0854)\n\n - An elevation of privilege vulnerability exists when the\n DirectX Graphics Kernel (DXGKRNL) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8165)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge. The vulnerability could\n corrupt memory in such a way that an attacker could\n execute arbitrary code in the context of the current\n user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2018-0943, CVE-2018-8133)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - A security feature bypass vulnerability exists when\n Internet Explorer fails to validate User Mode Code\n Integrity (UMCI) policies. The vulnerability could allow\n an attacker to bypass Device Guard UMCI policies.\n (CVE-2018-8126)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A remote code execution vulnerability exists when\n Microsoft Edge improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8179)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Microsoft Edge. The vulnerability could corrupt memory\n in such a way that an attacker could execute arbitrary\n code in the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-0946,\n CVE-2018-0951, CVE-2018-0953, CVE-2018-8128,\n CVE-2018-8137)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows kernel image handles objects in\n memory. An attacker who successfully exploited the\n vulnerability could execute code with elevated\n permissions. (CVE-2018-8170)", "edition": 27, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2018-05-08T00:00:00", "title": "KB4103731: Windows 10 Version 1703 May 2018 Security Update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-0946", "CVE-2018-8134", "CVE-2018-0961", "CVE-2018-0854", "CVE-2018-8136", "CVE-2018-8126", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-8170", "CVE-2018-8132", "CVE-2018-0955", "CVE-2018-8179", "CVE-2018-0951", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8165", "CVE-2018-0953", "CVE-2018-8124", "CVE-2018-8112", "CVE-2018-8128", "CVE-2018-8133", "CVE-2018-0958", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8897", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2018-8129", "CVE-2018-8137", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-0943", "CVE-2018-1025"], "modified": "2018-05-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS18_MAY_4103731.NASL", "href": "https://www.tenable.com/plugins/nessus/109611", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109611);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/08/18\");\n\n script_cve_id(\n \"CVE-2018-0765\",\n \"CVE-2018-0824\",\n \"CVE-2018-0854\",\n \"CVE-2018-0943\",\n \"CVE-2018-0946\",\n \"CVE-2018-0951\",\n \"CVE-2018-0953\",\n \"CVE-2018-0954\",\n \"CVE-2018-0955\",\n \"CVE-2018-0958\",\n \"CVE-2018-0959\",\n \"CVE-2018-0961\",\n \"CVE-2018-1022\",\n \"CVE-2018-1025\",\n \"CVE-2018-1039\",\n \"CVE-2018-8112\",\n \"CVE-2018-8114\",\n \"CVE-2018-8122\",\n \"CVE-2018-8124\",\n \"CVE-2018-8126\",\n \"CVE-2018-8127\",\n \"CVE-2018-8128\",\n \"CVE-2018-8129\",\n \"CVE-2018-8132\",\n \"CVE-2018-8133\",\n \"CVE-2018-8134\",\n \"CVE-2018-8136\",\n \"CVE-2018-8137\",\n \"CVE-2018-8145\",\n \"CVE-2018-8164\",\n \"CVE-2018-8165\",\n \"CVE-2018-8166\",\n \"CVE-2018-8167\",\n \"CVE-2018-8170\",\n \"CVE-2018-8174\",\n \"CVE-2018-8178\",\n \"CVE-2018-8179\",\n \"CVE-2018-8897\"\n );\n script_xref(name:\"MSKB\", value:\"4103731\");\n script_xref(name:\"MSFT\", value:\"MS18-4103731\");\n\n script_name(english:\"KB4103731: Windows 10 Version 1703 May 2018 Security Update\");\n script_summary(english:\"Checks for rollup.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4103731.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate vSMB packet data. An attacker who successfully\n exploited these vulnerabilities could execute arbitrary\n code on a target operating system. To exploit these\n vulnerabilities, an attacker running inside a virtual\n machine could run a specially crafted application that\n could cause the Hyper-V host operating system to execute\n arbitrary code. The update addresses the vulnerabilities\n by correcting how Windows Hyper-V validates vSMB packet\n data. (CVE-2018-0961)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A security feature bypass vulnerability exists in\n Windows which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-0958,\n CVE-2018-8129, CVE-2018-8132)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A security feature bypass vulnerability exists when\n Microsoft Edge improperly handles requests of different\n origins. The vulnerability allows Microsoft Edge to\n bypass Same-Origin Policy (SOP) restrictions, and to\n allow requests that should otherwise be ignored. An\n attacker who successfully exploited the vulnerability\n could force the browser to send data that would\n otherwise be restricted. (CVE-2018-8112)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A security feature bypass vulnerability exists in\n Windows Scripting Host which could allow an attacker to\n bypass Device Guard. An attacker who successfully\n exploited this vulnerability could circumvent a User\n Mode Code Integrity (UMCI) policy on the machine.\n (CVE-2018-0854)\n\n - An elevation of privilege vulnerability exists when the\n DirectX Graphics Kernel (DXGKRNL) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8165)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge. The vulnerability could\n corrupt memory in such a way that an attacker could\n execute arbitrary code in the context of the current\n user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2018-0943, CVE-2018-8133)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - A security feature bypass vulnerability exists when\n Internet Explorer fails to validate User Mode Code\n Integrity (UMCI) policies. The vulnerability could allow\n an attacker to bypass Device Guard UMCI policies.\n (CVE-2018-8126)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A remote code execution vulnerability exists when\n Microsoft Edge improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8179)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Microsoft Edge. The vulnerability could corrupt memory\n in such a way that an attacker could execute arbitrary\n code in the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-0946,\n CVE-2018-0951, CVE-2018-0953, CVE-2018-8128,\n CVE-2018-8137)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows kernel image handles objects in\n memory. An attacker who successfully exploited the\n vulnerability could execute code with elevated\n permissions. (CVE-2018-8170)\");\n # https://support.microsoft.com/en-us/help/4103731/windows-10-update-kb4103731\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e6fc001a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB4103731.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-8136\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS18-05\";\nkbs = make_list('4103731');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"15063\",\n rollup_date:\"05_2018\",\n bulletin:bulletin,\n rollup_kb_list:[4103731])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-08-19T05:13:18", "description": "The remote Windows host is missing security update 4103721.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate vSMB packet data. An attacker who successfully\n exploited these vulnerabilities could execute arbitrary\n code on a target operating system. To exploit these\n vulnerabilities, an attacker running inside a virtual\n machine could run a specially crafted application that\n could cause the Hyper-V host operating system to execute\n arbitrary code. The update addresses the vulnerabilities\n by correcting how Windows Hyper-V validates vSMB packet\n data. (CVE-2018-0961)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A security feature bypass vulnerability exists in\n Windows which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-0958,\n CVE-2018-8129, CVE-2018-8132)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge. The vulnerability could\n corrupt memory in such a way that an attacker could\n execute arbitrary code in the context of the current\n user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2018-0943, CVE-2018-8130,\n CVE-2018-8133)\n\n - A security feature bypass vulnerability exists when\n Microsoft Edge improperly handles requests of different\n origins. The vulnerability allows Microsoft Edge to\n bypass Same-Origin Policy (SOP) restrictions, and to\n allow requests that should otherwise be ignored. An\n attacker who successfully exploited the vulnerability\n could force the browser to send data that would\n otherwise be restricted. (CVE-2018-8112)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - An elevation of privilege vulnerability exists when the\n DirectX Graphics Kernel (DXGKRNL) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8165)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - A security feature bypass vulnerability exists when\n Internet Explorer fails to validate User Mode Code\n Integrity (UMCI) policies. The vulnerability could allow\n an attacker to bypass Device Guard UMCI policies.\n (CVE-2018-8126)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A remote code execution vulnerability exists when\n Microsoft Edge improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8179)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Microsoft Edge. The vulnerability could corrupt memory\n in such a way that an attacker could execute arbitrary\n code in the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-0945,\n CVE-2018-0946, CVE-2018-0953, CVE-2018-8128,\n CVE-2018-8137, CVE-2018-8139)", "edition": 27, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2018-05-08T00:00:00", "title": "KB4103721: Windows 10 Version 1803 and Windows Server Version 1803 May 2018 Security Update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-0946", "CVE-2018-8134", "CVE-2018-0961", "CVE-2018-8136", "CVE-2018-8126", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-8132", "CVE-2018-0955", "CVE-2018-8179", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8165", "CVE-2018-0945", "CVE-2018-0953", "CVE-2018-8124", "CVE-2018-8112", "CVE-2018-8128", "CVE-2018-8133", "CVE-2018-0958", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8897", "CVE-2018-8130", "CVE-2018-8122", "CVE-2018-8139", "CVE-2018-8167", "CVE-2018-8166", "CVE-2018-8129", "CVE-2018-8137", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-0943", "CVE-2018-1025"], "modified": "2018-05-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS18_MAY_4103721.NASL", "href": "https://www.tenable.com/plugins/nessus/109605", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109605);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/08/18\");\n\n script_cve_id(\n \"CVE-2018-0765\",\n \"CVE-2018-0824\",\n \"CVE-2018-0943\",\n \"CVE-2018-0945\",\n \"CVE-2018-0946\",\n \"CVE-2018-0953\",\n \"CVE-2018-0954\",\n \"CVE-2018-0955\",\n \"CVE-2018-0958\",\n \"CVE-2018-0959\",\n \"CVE-2018-0961\",\n \"CVE-2018-1022\",\n \"CVE-2018-1025\",\n \"CVE-2018-1039\",\n \"CVE-2018-8112\",\n \"CVE-2018-8114\",\n \"CVE-2018-8122\",\n \"CVE-2018-8124\",\n \"CVE-2018-8126\",\n \"CVE-2018-8127\",\n \"CVE-2018-8128\",\n \"CVE-2018-8129\",\n \"CVE-2018-8130\",\n \"CVE-2018-8132\",\n \"CVE-2018-8133\",\n \"CVE-2018-8134\",\n \"CVE-2018-8136\",\n \"CVE-2018-8137\",\n \"CVE-2018-8139\",\n \"CVE-2018-8145\",\n \"CVE-2018-8164\",\n \"CVE-2018-8165\",\n \"CVE-2018-8166\",\n \"CVE-2018-8167\",\n \"CVE-2018-8174\",\n \"CVE-2018-8178\",\n \"CVE-2018-8179\",\n \"CVE-2018-8897\"\n );\n script_xref(name:\"MSKB\", value:\"4103721\");\n script_xref(name:\"MSFT\", value:\"MS18-4103721\");\n\n script_name(english:\"KB4103721: Windows 10 Version 1803 and Windows Server Version 1803 May 2018 Security Update\");\n script_summary(english:\"Checks for rollup.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4103721.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate vSMB packet data. An attacker who successfully\n exploited these vulnerabilities could execute arbitrary\n code on a target operating system. To exploit these\n vulnerabilities, an attacker running inside a virtual\n machine could run a specially crafted application that\n could cause the Hyper-V host operating system to execute\n arbitrary code. The update addresses the vulnerabilities\n by correcting how Windows Hyper-V validates vSMB packet\n data. (CVE-2018-0961)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A security feature bypass vulnerability exists in\n Windows which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-0958,\n CVE-2018-8129, CVE-2018-8132)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge. The vulnerability could\n corrupt memory in such a way that an attacker could\n execute arbitrary code in the context of the current\n user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2018-0943, CVE-2018-8130,\n CVE-2018-8133)\n\n - A security feature bypass vulnerability exists when\n Microsoft Edge improperly handles requests of different\n origins. The vulnerability allows Microsoft Edge to\n bypass Same-Origin Policy (SOP) restrictions, and to\n allow requests that should otherwise be ignored. An\n attacker who successfully exploited the vulnerability\n could force the browser to send data that would\n otherwise be restricted. (CVE-2018-8112)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - An elevation of privilege vulnerability exists when the\n DirectX Graphics Kernel (DXGKRNL) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8165)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - A security feature bypass vulnerability exists when\n Internet Explorer fails to validate User Mode Code\n Integrity (UMCI) policies. The vulnerability could allow\n an attacker to bypass Device Guard UMCI policies.\n (CVE-2018-8126)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - A remote code execution vulnerability exists when\n Microsoft Edge improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8179)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Microsoft Edge. The vulnerability could corrupt memory\n in such a way that an attacker could execute arbitrary\n code in the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-0945,\n CVE-2018-0946, CVE-2018-0953, CVE-2018-8128,\n CVE-2018-8137, CVE-2018-8139)\");\n # https://support.microsoft.com/en-us/help/4103721/windows-10-update-kb4103721\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?9d0d5cd2\");\n script_set_attribute(attribute:\"solution\", value:\n \"Apply Cumulative Update KB4103721.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-8136\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS18-05\";\nkbs = make_list('4103721');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"17134\",\n rollup_date:\"05_2018\",\n bulletin:bulletin,\n rollup_kb_list:[4103721])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-08-19T05:13:19", "description": "The remote Windows host is missing security update 4103727.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127, CVE-2018-8141)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate vSMB packet data. An attacker who successfully\n exploited these vulnerabilities could execute arbitrary\n code on a target operating system. To exploit these\n vulnerabilities, an attacker running inside a virtual\n machine could run a specially crafted application that\n could cause the Hyper-V host operating system to execute\n arbitrary code. The update addresses the vulnerabilities\n by correcting how Windows Hyper-V validates vSMB packet\n data. (CVE-2018-0961)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - A remote code execution vulnerability exists when\n Microsoft Edge improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8123,\n CVE-2018-8179)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A security feature bypass vulnerability exists in\n Windows which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-0958,\n CVE-2018-8129, CVE-2018-8132)\n\n - An information disclosure vulnerability exists when\n Microsoft Edge improperly handles objects in memory. An\n attacker who successfully exploited the vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-1021)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge. The vulnerability could\n corrupt memory in such a way that an attacker could\n execute arbitrary code in the context of the current\n user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2018-0943, CVE-2018-8130,\n CVE-2018-8133)\n\n - A security feature bypass vulnerability exists when\n Microsoft Edge improperly handles requests of different\n origins. The vulnerability allows Microsoft Edge to\n bypass Same-Origin Policy (SOP) restrictions, and to\n allow requests that should otherwise be ignored. An\n attacker who successfully exploited the vulnerability\n could force the browser to send data that would\n otherwise be restricted. (CVE-2018-8112)\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A security feature bypass vulnerability exists in\n Windows Scripting Host which could allow an attacker to\n bypass Device Guard. An attacker who successfully\n exploited this vulnerability could circumvent a User\n Mode Code Integrity (UMCI) policy on the machine.\n (CVE-2018-0854)\n\n - An elevation of privilege vulnerability exists when the\n DirectX Graphics Kernel (DXGKRNL) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8165)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - A security feature bypass vulnerability exists when\n Internet Explorer fails to validate User Mode Code\n Integrity (UMCI) policies. The vulnerability could allow\n an attacker to bypass Device Guard UMCI policies.\n (CVE-2018-8126)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Microsoft Edge. The vulnerability could corrupt memory\n in such a way that an attacker could execute arbitrary\n code in the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-0946,\n CVE-2018-0951, CVE-2018-0953, CVE-2018-8128,\n CVE-2018-8137)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows kernel image handles objects in\n memory. An attacker who successfully exploited the\n vulnerability could execute code with elevated\n permissions. (CVE-2018-8170)", "edition": 27, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2018-05-08T00:00:00", "title": "KB4103727: Windows 10 Version 1709 and Windows Server Version 1709 May 2018 Security Update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-0946", "CVE-2018-8134", "CVE-2018-0961", "CVE-2018-0854", "CVE-2018-8136", "CVE-2018-8126", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-8170", "CVE-2018-8132", "CVE-2018-1021", "CVE-2018-0955", "CVE-2018-8179", "CVE-2018-0951", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8165", "CVE-2018-0953", "CVE-2018-8124", "CVE-2018-8112", "CVE-2018-8128", "CVE-2018-8123", "CVE-2018-8133", "CVE-2018-0958", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8141", "CVE-2018-8897", "CVE-2018-8130", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2018-8129", "CVE-2018-8137", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-0943", "CVE-2018-1025"], "modified": "2018-05-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS18_MAY_4103727.NASL", "href": "https://www.tenable.com/plugins/nessus/109608", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109608);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/08/18\");\n\n script_cve_id(\n \"CVE-2018-0765\",\n \"CVE-2018-0824\",\n \"CVE-2018-0854\",\n \"CVE-2018-0943\",\n \"CVE-2018-0946\",\n \"CVE-2018-0951\",\n \"CVE-2018-0953\",\n \"CVE-2018-0954\",\n \"CVE-2018-0955\",\n \"CVE-2018-0958\",\n \"CVE-2018-0959\",\n \"CVE-2018-0961\",\n \"CVE-2018-1021\",\n \"CVE-2018-1022\",\n \"CVE-2018-1025\",\n \"CVE-2018-1039\",\n \"CVE-2018-8112\",\n \"CVE-2018-8114\",\n \"CVE-2018-8122\",\n \"CVE-2018-8123\",\n \"CVE-2018-8124\",\n \"CVE-2018-8126\",\n \"CVE-2018-8127\",\n \"CVE-2018-8128\",\n \"CVE-2018-8129\",\n \"CVE-2018-8130\",\n \"CVE-2018-8132\",\n \"CVE-2018-8133\",\n \"CVE-2018-8134\",\n \"CVE-2018-8136\",\n \"CVE-2018-8137\",\n \"CVE-2018-8141\",\n \"CVE-2018-8145\",\n \"CVE-2018-8164\",\n \"CVE-2018-8165\",\n \"CVE-2018-8166\",\n \"CVE-2018-8167\",\n \"CVE-2018-8170\",\n \"CVE-2018-8174\",\n \"CVE-2018-8178\",\n \"CVE-2018-8179\",\n \"CVE-2018-8897\"\n );\n script_xref(name:\"MSKB\", value:\"4103727\");\n script_xref(name:\"MSFT\", value:\"MS18-4103727\");\n\n script_name(english:\"KB4103727: Windows 10 Version 1709 and Windows Server Version 1709 May 2018 Security Update\");\n script_summary(english:\"Checks for rollup.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4103727.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A security feature bypass vulnerability exists in .Net\n Framework which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-1039)\n\n - A remote code execution vulnerability exists in the way\n that Microsoft browsers access objects in memory. The\n vulnerability could corrupt memory in a way that could\n allow an attacker to execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8178)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-8127, CVE-2018-8141)\n\n - A remote code execution vulnerability exists in\n Microsoft COM for Windows when it fails to\n properly handle serialized objects. An attacker who\n successfully exploited the vulnerability could use a\n specially crafted file or script to perform actions. In\n an email attack scenario, an attacker could exploit the\n vulnerability by sending the specially crafted file to\n the user and convincing the user to open the file.\n (CVE-2018-0824)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate vSMB packet data. An attacker who successfully\n exploited these vulnerabilities could execute arbitrary\n code on a target operating system. To exploit these\n vulnerabilities, an attacker running inside a virtual\n machine could run a specially crafted application that\n could cause the Hyper-V host operating system to execute\n arbitrary code. The update addresses the vulnerabilities\n by correcting how Windows Hyper-V validates vSMB packet\n data. (CVE-2018-0961)\n\n - An information disclosure vulnerability exists when\n affected Microsoft browsers improperly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could obtain information to further\n compromise the users system. (CVE-2018-1025)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Internet Explorer. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0955, CVE-2018-8114, CVE-2018-8122)\n\n - A remote code execution vulnerability exists when\n Microsoft Edge improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-8123,\n CVE-2018-8179)\n\n - An elevation of privilege vulnerability exists when the\n Windows Common Log File System (CLFS) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8167)\n\n - A security feature bypass vulnerability exists in\n Windows which could allow an attacker to bypass Device\n Guard. An attacker who successfully exploited this\n vulnerability could circumvent a User Mode Code\n Integrity (UMCI) policy on the machine. (CVE-2018-0958,\n CVE-2018-8129, CVE-2018-8132)\n\n - An information disclosure vulnerability exists when\n Microsoft Edge improperly handles objects in memory. An\n attacker who successfully exploited the vulnerability\n could obtain information to further compromise the users\n system. (CVE-2018-1021)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2018-8174)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge. The vulnerability could\n corrupt memory in such a way that an attacker could\n execute arbitrary code in the context of the current\n user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2018-0943, CVE-2018-8130,\n CVE-2018-8133)\n\n - A security feature bypass vulnerability exists when\n Microsoft Edge improperly handles requests of different\n origins. The vulnerability allows Microsoft Edge to\n bypass Same-Origin Policy (SOP) restrictions, and to\n allow requests that should otherwise be ignored. An\n attacker who successfully exploited the vulnerability\n could force the browser to send data that would\n otherwise be restricted. (CVE-2018-8112)\n\n - An elevation of privilege vulnerability exists when the\n Windows kernel fails to properly handle objects in\n memory. An attacker who successfully exploited this\n vulnerability could run arbitrary code in kernel mode.\n An attacker could then install programs; view, change,\n or delete data; or create new accounts with full user\n rights. (CVE-2018-8897)\n\n - An information disclosure vulnerability exists when\n Chakra improperly discloses the contents of its memory,\n which could provide an attacker with information to\n further compromise the users computer or data.\n (CVE-2018-8145)\n\n - A security feature bypass vulnerability exists in\n Windows Scripting Host which could allow an attacker to\n bypass Device Guard. An attacker who successfully\n exploited this vulnerability could circumvent a User\n Mode Code Integrity (UMCI) policy on the machine.\n (CVE-2018-0854)\n\n - An elevation of privilege vulnerability exists when the\n DirectX Graphics Kernel (DXGKRNL) driver improperly\n handles objects in memory. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. (CVE-2018-8165)\n\n - A remote code execution vulnerability exists in the way\n that Windows handles objects in memory. An attacker who\n successfully exploited the vulnerability could execute\n arbitrary code with elevated permissions on a target\n system. (CVE-2018-8136)\n\n - A remote code execution vulnerability exists when\n Windows Hyper-V on a host server fails to properly\n validate input from an authenticated user on a guest\n operating system. (CVE-2018-0959)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Win32k component fails to properly\n handle objects in memory. An attacker who successfully\n exploited this vulnerability could run arbitrary code in\n kernel mode. An attacker could then install programs;\n view, change, or delete data; or create new accounts\n with full user rights. (CVE-2018-8124, CVE-2018-8164,\n CVE-2018-8166)\n\n - A security feature bypass vulnerability exists when\n Internet Explorer fails to validate User Mode Code\n Integrity (UMCI) policies. The vulnerability could allow\n an attacker to bypass Device Guard UMCI policies.\n (CVE-2018-8126)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows Kernel API enforces permissions. An\n attacker who successfully exploited the vulnerability\n could impersonate processes, interject cross-process\n communication, or interrupt system functionality.\n (CVE-2018-8134)\n\n - A denial of service vulnerability exists when .NET and\n .NET Core improperly process XML documents. An attacker\n who successfully exploited this vulnerability could\n cause a denial of service against a .NET application. A\n remote unauthenticated attacker could exploit this\n vulnerability by issuing specially crafted requests to a\n .NET (or .NET core) application. The update addresses\n the vulnerability by correcting how .NET and .NET Core\n applications handle XML document processing.\n (CVE-2018-0765)\n\n - A remote code execution vulnerability exists in the way\n that the scripting engine handles objects in memory in\n Microsoft Edge. The vulnerability could corrupt memory\n in such a way that an attacker could execute arbitrary\n code in the context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2018-0946,\n CVE-2018-0951, CVE-2018-0953, CVE-2018-8128,\n CVE-2018-8137)\n\n - A remote code execution vulnerability exists in the way\n the scripting engine handles objects in memory in\n Microsoft browsers. The vulnerability could corrupt\n memory in such a way that an attacker could execute\n arbitrary code in the context of the current user. An\n attacker who successfully exploited the vulnerability\n could gain the same user rights as the current user.\n (CVE-2018-0954, CVE-2018-1022)\n\n - An elevation of privilege vulnerability exists in the\n way that the Windows kernel image handles objects in\n memory. An attacker who successfully exploited the\n vulnerability could execute code with elevated\n permissions. (CVE-2018-8170)\");\n # https://support.microsoft.com/en-us/help/4103727/windows-10-update-kb4103727\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?41c43cb2\");\n script_set_attribute(attribute:\"solution\", value:\n \"Apply Cumulative Update KB4103727.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-8136\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS18-05\";\nkbs = make_list('4103727');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"16299\",\n rollup_date:\"05_2018\",\n bulletin:bulletin,\n rollup_kb_list:[4103727])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2020-06-08T23:06:06", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-8174", "CVE-2018-8136", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-0955", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8124", "CVE-2018-8145", "CVE-2018-8897", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2017-11927", "CVE-2018-0886", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-8120", "CVE-2018-1025"], "description": "This host is missing a critical security\n update according to Microsoft KB4103718", "modified": "2020-06-04T00:00:00", "published": "2018-05-09T00:00:00", "id": "OPENVAS:1361412562310813336", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813336", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4103718)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Microsoft Windows Multiple Vulnerabilities (KB4103718)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813336\");\n script_version(\"2020-06-04T11:13:22+0000\");\n script_cve_id(\"CVE-2018-0954\", \"CVE-2018-0955\", \"CVE-2018-0959\", \"CVE-2018-1022\",\n \"CVE-2018-1025\", \"CVE-2018-8114\", \"CVE-2018-8120\", \"CVE-2018-8122\",\n \"CVE-2018-8124\", \"CVE-2018-8127\", \"CVE-2018-8136\", \"CVE-2018-8145\",\n \"CVE-2018-8164\", \"CVE-2018-8166\", \"CVE-2018-8167\", \"CVE-2018-8174\",\n \"CVE-2018-8178\", \"CVE-2018-8897\", \"CVE-2018-0824\", \"CVE-2017-11927\",\n \"CVE-2018-0886\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 11:13:22 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-05-09 08:12:54 +0530 (Wed, 09 May 2018)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4103718)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4103718\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaw exists due to,\n\n - Microsoft browsers improperly access objects in memory.\n\n - The Win32k component fails to properly handle objects in memory.\n\n - Windows kernel fails to properly handle objects in memory.\n\n - The VBScript engine improperly handles objects in memory.\n\n - The scripting engine improperly handles objects in memory in Microsoft browsers.\n\n - Windows Common Log File System (CLFS) driver improperly handles objects in memory.\n\n - Chakra improperly discloses the contents of its memory.\n\n - Windows Hyper-V on a host server fails to properly validate input from an\n authenticated user on a guest operating system.\n\n - Windows 'its://' protocol handler unnecessarily sends traffic to a remote site\n in order to determine the zone of a provided URL.\n\n - An error in Credential Security Support Provider protocol (CredSSP).\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow\n attackers to gain the same user rights as the current user, run arbitrary\n code, disclose sensitive information and run processes in an elevated context\n and it may lead to further compromise of the system.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 7 for 32-bit/x64 Systems Service Pack 1\n\n - Microsoft Windows Server 2008 R2 for x64-based Systems Service Pack 1\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4103718\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win7:2, win7x64:2, win2008r2:2) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath){\n exit(0);\n}\n\nfileVer = fetch_file_version(sysPath:sysPath, file_name:\"advapi32.dll\");\nif(!fileVer){\n exit(0);\n}\n\nif(version_is_less(version:fileVer, test_version:\"6.1.7601.24117\"))\n{\n report = report_fixed_ver(file_checked:sysPath + \"\\advapi32.dll\",\n file_version:fileVer, vulnerable_range:\"Less than 6.1.7601.24117\");\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-08T13:29:07", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-8174", "CVE-2018-8134", "CVE-2018-8136", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-0955", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8124", "CVE-2018-8145", "CVE-2018-8897", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2017-11927", "CVE-2018-0886", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-1025"], "description": "This host is missing a critical security\n update according to Microsoft KB4103725", "modified": "2019-12-20T00:00:00", "published": "2018-05-09T00:00:00", "id": "OPENVAS:1361412562310813338", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813338", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4103725)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Microsoft Windows Multiple Vulnerabilities (KB4103725)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813338\");\n script_version(\"2019-12-20T10:24:46+0000\");\n script_cve_id(\"CVE-2018-0954\", \"CVE-2018-0955\", \"CVE-2018-0959\", \"CVE-2018-1022\",\n \"CVE-2018-1025\", \"CVE-2018-8114\", \"CVE-2018-8122\", \"CVE-2018-8124\",\n \"CVE-2018-8127\", \"CVE-2018-8134\", \"CVE-2018-8136\", \"CVE-2018-8145\",\n \"CVE-2018-8164\", \"CVE-2018-8166\", \"CVE-2018-8167\", \"CVE-2018-8174\",\n \"CVE-2018-8178\", \"CVE-2018-8897\", \"CVE-2018-0824\", \"CVE-2018-0886\",\n \"CVE-2017-11927\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-12-20 10:24:46 +0000 (Fri, 20 Dec 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-05-09 08:59:54 +0530 (Wed, 09 May 2018)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4103725)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4103725\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaw exists due to,\n\n - Microsoft browsers improperly access objects in memory.\n\n - The Win32k component fails to properly handle objects in memory.\n\n - Windows kernel fails to properly handle objects in memory.\n\n - The VBScript engine improperly handles objects in memory.\n\n - The scripting engine improperly handles objects in memory in Microsoft browsers.\n\n - Windows Common Log File System (CLFS) driver improperly handles objects in memory.\n\n - Chakra improperly discloses the contents of its memory.\n\n - Windows Hyper-V on a host server fails to properly validate input from an\n authenticated user on a guest operating system.\n\n - Windows 'its://' protocol handler unnecessarily sends traffic to a remote site\n in order to determine the zone of a provided URL.\n\n - An error in Credential Security Support Provider protocol (CredSSP).\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow\n attackers to gain the same user rights as the current user, run arbitrary\n code, disclose sensitive information and run processes in an elevated context\n and it may lead to further compromise of the system.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 8.1 for 32-bit/x64\n\n - Microsoft Windows Server 2012 R2\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4103725\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win8_1:1, win8_1x64:1, win2012R2:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath ){\n exit(0);\n}\n\nfileVer = fetch_file_version(sysPath:sysPath, file_name:\"mshtml.dll\");\nif(!fileVer){\n exit(0);\n}\n\nif(version_is_less(version:fileVer, test_version:\"11.0.9600.19003\"))\n{\n report = report_fixed_ver(file_checked:sysPath + \"\\mshtml.dll\",\n file_version:fileVer, vulnerable_range:\"Less than 11.0.9600.19003\");\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-08T13:28:52", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-8134", "CVE-2018-0961", "CVE-2018-0854", "CVE-2018-8136", "CVE-2018-8126", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-8132", "CVE-2018-0955", "CVE-2018-8179", "CVE-2018-0951", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8165", "CVE-2018-0953", "CVE-2018-8124", "CVE-2018-8112", "CVE-2018-8133", "CVE-2018-0958", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8897", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2017-11927", "CVE-2018-8129", "CVE-2018-0886", "CVE-2018-8137", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-0943", "CVE-2018-1025"], "description": "This host is missing a critical security\n update according to Microsoft KB4103723", "modified": "2019-12-20T00:00:00", "published": "2018-05-09T00:00:00", "id": "OPENVAS:1361412562310813340", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813340", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4103723)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Microsoft Windows Multiple Vulnerabilities (KB4103723)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813340\");\n script_version(\"2019-12-20T10:24:46+0000\");\n script_cve_id(\"CVE-2018-0765\", \"CVE-2018-0954\", \"CVE-2018-0955\", \"CVE-2018-0958\",\n \"CVE-2018-0959\", \"CVE-2018-0961\", \"CVE-2018-1022\", \"CVE-2018-1025\",\n \"CVE-2018-1039\", \"CVE-2018-8112\", \"CVE-2018-8114\", \"CVE-2018-8122\",\n \"CVE-2018-8124\", \"CVE-2018-8126\", \"CVE-2018-8127\", \"CVE-2018-8129\",\n \"CVE-2018-8132\", \"CVE-2018-8133\", \"CVE-2018-8134\", \"CVE-2018-8136\",\n \"CVE-2018-8137\", \"CVE-2018-8145\", \"CVE-2018-8164\", \"CVE-2018-8165\",\n \"CVE-2018-8166\", \"CVE-2018-8167\", \"CVE-2018-8174\", \"CVE-2018-8178\",\n \"CVE-2018-8179\", \"CVE-2018-8897\", \"CVE-2018-0824\", \"CVE-2018-0854\",\n \"CVE-2018-0943\", \"CVE-2018-0951\", \"CVE-2018-0953\", \"CVE-2017-11927\",\n \"CVE-2018-0886\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-12-20 10:24:46 +0000 (Fri, 20 Dec 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-05-09 10:00:32 +0530 (Wed, 09 May 2018)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4103723)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4103723\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaw exists due to,\n\n - Windows Common Log File System (CLFS) driver improperly handles objects in\n memory.\n\n - The Win32k component fails to properly handle objects in memory.\n\n - The DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects\n in memory.\n\n - Windows kernel fails to properly handle objects in memory.\n\n - Chakra improperly discloses the contents of its memory.\n\n - Scripting engine improperly handles objects in memory in microsoft browsers.\n\n - Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies.\n\n - Microsoft browsers improperly handle objects in memory.\n\n - Windows Hyper-V on a host server fails to properly validate vSMB packet data.\n\n - Chakra scripting engine improperly handles objects in memory.\n\n - Windows Kernel API improperly enforces permissions.\n\n - Windows Hyper-V on a host server fails to properly validate input from an\n authenticated user on a guest operating system.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run processes in an elevated context, run arbitrary code in kernel mode,\n bypass security restrictions, obtain information to further compromise the\n user's system, interrupt system functionality and cause denial of service\n condition.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 10 Version 1607 x32/x64\n\n - Microsoft Windows Server 2016\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4103723\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1, win2016:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath ){\n exit(0);\n}\n\nedgeVer = fetch_file_version(sysPath:sysPath, file_name:\"edgehtml.dll\");\nif(!edgeVer){\n exit(0);\n}\n\nif(version_in_range(version:edgeVer, test_version:\"11.0.14393.0\", test_version2:\"11.0.14393.2247\"))\n{\n report = report_fixed_ver(file_checked:sysPath + \"\\Edgehtml.dll\",\n file_version:edgeVer, vulnerable_range:\"11.0.14393.0 - 11.0.14393.2247\");\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-08T23:06:19", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-8134", "CVE-2018-0854", "CVE-2018-8136", "CVE-2018-8126", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-8132", "CVE-2018-0955", "CVE-2018-8179", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8165", "CVE-2018-0953", "CVE-2018-8124", "CVE-2018-8112", "CVE-2018-8133", "CVE-2018-0958", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8897", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2017-11927", "CVE-2018-8129", "CVE-2018-0886", "CVE-2018-8137", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-0943", "CVE-2018-1025"], "description": "This host is missing a critical security\n update according to Microsoft KB4103716", "modified": "2020-06-04T00:00:00", "published": "2018-05-09T00:00:00", "id": "OPENVAS:1361412562310813342", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813342", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4103716)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Microsoft Windows Multiple Vulnerabilities (KB4103716)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813342\");\n script_version(\"2020-06-04T11:13:22+0000\");\n script_cve_id(\"CVE-2018-0765\", \"CVE-2018-0954\", \"CVE-2018-0955\", \"CVE-2018-0958\",\n \"CVE-2018-0959\", \"CVE-2018-1022\", \"CVE-2018-1025\", \"CVE-2018-1039\",\n \"CVE-2018-8112\", \"CVE-2018-8114\", \"CVE-2018-8122\", \"CVE-2018-8124\",\n \"CVE-2018-8126\", \"CVE-2018-8127\", \"CVE-2018-8129\", \"CVE-2018-8132\",\n \"CVE-2018-8133\", \"CVE-2018-8134\", \"CVE-2018-8136\", \"CVE-2018-8137\",\n \"CVE-2018-8145\", \"CVE-2018-8164\", \"CVE-2018-8165\", \"CVE-2018-8166\",\n \"CVE-2018-8167\", \"CVE-2018-8174\", \"CVE-2018-8178\", \"CVE-2018-8179\",\n \"CVE-2018-8897\", \"CVE-2018-0824\", \"CVE-2018-0854\", \"CVE-2018-0943\",\n \"CVE-2018-0953\", \"CVE-2018-0886\", \"CVE-2017-11927\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 11:13:22 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-05-09 10:30:13 +0530 (Wed, 09 May 2018)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4103716)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4103716\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaw exists due to,\n\n - Windows Common Log File System (CLFS) driver improperly handles objects in\n memory.\n\n - The Win32k component fails to properly handle objects in memory.\n\n - The DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects\n in memory.\n\n - Windows kernel fails to properly handle objects in memory.\n\n - Chakra improperly discloses the contents of its memory.\n\n - Scripting engine improperly handles objects in memory in microsoft browsers.\n\n - Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies.\n\n - Chakra scripting engine improperly handles objects in memory in\n Microsoft Edge.\n\n - Windows Kernel API improperly enforces permissions.\n\n - Microsoft Edge improperly handles requests of different origins.\n\n - Windows Hyper-V on a host server fails to properly validate input from an\n authenticated user on a guest operating system.\n\n - Windows 'its://' protocol handler unnecessarily sends traffic to a remote site in\n order to determine the zone of a provided URL.\n\n - An error in Credential Security Support Provider protocol (CredSSP).\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run processes in an elevated context, run arbitrary code in kernel mode,\n circumvent a User Mode Code Integrity (UMCI) policy on the machine, gain the\n same user rights as the current user, discloses information to further\n compromise the user's computer or data, interrupt system functionality and\n cause denial of service condition.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 10 for 32-bit Systems\n\n - Microsoft Windows 10 for x64-based Systems\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4103716\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath ){\n exit(0);\n}\n\nedgeVer = fetch_file_version(sysPath:sysPath, file_name:\"edgehtml.dll\");\nif(!edgeVer){\n exit(0);\n}\n\nif(version_in_range(version:edgeVer, test_version:\"11.0.10240.0\", test_version2:\"11.0.10240.17860\"))\n{\n report = report_fixed_ver(file_checked:sysPath + \"\\Edgehtml.dll\",\n file_version:edgeVer, vulnerable_range:\"11.0.10240.0 - 11.0.10240.17860\");\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-08T23:06:06", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-0946", "CVE-2018-8134", "CVE-2018-0961", "CVE-2018-8136", "CVE-2018-8126", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-8132", "CVE-2018-0955", "CVE-2018-8179", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8165", "CVE-2018-0945", "CVE-2018-0953", "CVE-2018-8124", "CVE-2018-8112", "CVE-2018-8128", "CVE-2018-8133", "CVE-2018-0958", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8897", "CVE-2018-8130", "CVE-2018-8122", "CVE-2018-8139", "CVE-2018-8167", "CVE-2018-8166", "CVE-2018-8129", "CVE-2018-0886", "CVE-2018-8137", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-0943", "CVE-2018-1025"], "description": "This host is missing a critical security\n update according to Microsoft KB4103721", "modified": "2020-06-04T00:00:00", "published": "2018-05-09T00:00:00", "id": "OPENVAS:1361412562310813339", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813339", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4103721)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Microsoft Windows Multiple Vulnerabilities (KB4103721)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813339\");\n script_version(\"2020-06-04T11:13:22+0000\");\n script_cve_id(\"CVE-2018-0765\", \"CVE-2018-0954\", \"CVE-2018-0955\", \"CVE-2018-0958\",\n \"CVE-2018-0959\", \"CVE-2018-0961\", \"CVE-2018-1022\", \"CVE-2018-1025\",\n \"CVE-2018-1039\", \"CVE-2018-8112\", \"CVE-2018-8114\", \"CVE-2018-8122\",\n \"CVE-2018-8124\", \"CVE-2018-8126\", \"CVE-2018-8127\", \"CVE-2018-8128\",\n \"CVE-2018-8129\", \"CVE-2018-8130\", \"CVE-2018-8132\", \"CVE-2018-8133\",\n \"CVE-2018-8134\", \"CVE-2018-8136\", \"CVE-2018-8137\", \"CVE-2018-8139\",\n \"CVE-2018-8145\", \"CVE-2018-8164\", \"CVE-2018-8165\", \"CVE-2018-8166\",\n \"CVE-2018-8167\", \"CVE-2018-8174\", \"CVE-2018-8178\", \"CVE-2018-8179\",\n \"CVE-2018-8897\", \"CVE-2018-0824\", \"CVE-2018-0943\", \"CVE-2018-0945\",\n \"CVE-2018-0946\", \"CVE-2018-0953\", \"CVE-2018-0886\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 11:13:22 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-05-09 10:15:05 +0530 (Wed, 09 May 2018)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4103721)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4103721\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaw exists due to,\n\n - Windows Common Log File System (CLFS) driver improperly handles objects in\n memory.\n\n - The Win32k component fails to properly handle objects in memory.\n\n - The DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects\n in memory.\n\n - Windows kernel fails to properly handle objects in memory.\n\n - Scripting engine properly handles objects in memory in microsoft browsers.\n\n - Chakra improperly discloses the contents of its memory.\n\n - Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies.\n\n - Microsoft browsers improperly handle objects in memory.\n\n - Windows Hyper-V on a host server fails to properly validate vSMB packet\n data.\n\n - Chakra scripting engine handles objects in memory in Microsoft Edge.\n\n - Windows Kernel API improperly enforces permissions.\n\n - Microsoft Edge improperly handles requests of different origins.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run processes in an elevated context, run arbitrary code in kernel mode,\n circumvent a User Mode Code Integrity (UMCI) policy on the machine, gain the\n same user rights as the current user, discloses information to further\n compromise the user's computer or data, interrupt system functionality and cause\n denial of service condition.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 10 Version 1803 for 32-bit Systems\n\n - Microsoft Windows 10 Version 1803 for x64-based Systems\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4103721\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath ){\n exit(0);\n}\n\nedgeVer = fetch_file_version(sysPath:sysPath, file_name:\"edgehtml.dll\");\nif(!edgeVer){\n exit(0);\n}\n\nif(version_in_range(version:edgeVer, test_version:\"11.0.17134.0\", test_version2:\"11.0.17134.47\"))\n{\n report = report_fixed_ver(file_checked:sysPath + \"\\edgehtml.dll\",\n file_version:edgeVer, vulnerable_range:\"11.0.17134.0 - 11.0.17134.47\");\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-08T23:06:12", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-0946", "CVE-2018-8134", "CVE-2018-0961", "CVE-2018-0854", "CVE-2018-8136", "CVE-2018-8126", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-8170", "CVE-2018-8132", "CVE-2018-0955", "CVE-2018-8179", "CVE-2018-0951", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8165", "CVE-2018-0953", "CVE-2018-8124", "CVE-2018-8112", "CVE-2018-8128", "CVE-2018-8133", "CVE-2018-0958", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8897", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2017-11927", "CVE-2018-8129", "CVE-2018-0886", "CVE-2018-8137", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-0943", "CVE-2018-1025"], "description": "This host is missing a critical security\n update according to Microsoft KB4103731", "modified": "2020-06-04T00:00:00", "published": "2018-05-09T00:00:00", "id": "OPENVAS:1361412562310813341", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813341", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4103731)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Microsoft Windows Multiple Vulnerabilities (KB4103731)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813341\");\n script_version(\"2020-06-04T11:13:22+0000\");\n script_cve_id(\"CVE-2018-0765\", \"CVE-2018-8114\", \"CVE-2018-8122\", \"CVE-2018-8126\",\n \"CVE-2018-8127\", \"CVE-2018-8128\", \"CVE-2018-8129\", \"CVE-2018-8132\",\n \"CVE-2018-8133\", \"CVE-2018-8134\", \"CVE-2018-8136\", \"CVE-2018-8137\",\n \"CVE-2018-8145\", \"CVE-2018-8164\", \"CVE-2018-8165\", \"CVE-2018-8166\",\n \"CVE-2018-8167\", \"CVE-2018-8170\", \"CVE-2018-8174\", \"CVE-2018-8178\",\n \"CVE-2018-8179\", \"CVE-2018-8897\", \"CVE-2018-0886\", \"CVE-2018-0824\",\n \"CVE-2018-0854\", \"CVE-2018-0943\", \"CVE-2018-0946\", \"CVE-2018-0951\",\n \"CVE-2018-0953\", \"CVE-2018-0954\", \"CVE-2018-0955\", \"CVE-2018-0958\",\n \"CVE-2018-0959\", \"CVE-2018-0961\", \"CVE-2018-1022\", \"CVE-2018-1025\",\n \"CVE-2018-1039\", \"CVE-2018-8112\", \"CVE-2018-8124\", \"CVE-2017-11927\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 11:13:22 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-05-09 09:17:05 +0530 (Wed, 09 May 2018)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4103731)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4103731\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaw exists due to,\n\n - Windows Common Log File System (CLFS) driver improperly handles objects\n in memory.\n\n - The Win32k component fails to properly handle objects in memory.\n\n - The DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects\n in memory.\n\n - Windows kernel fails to properly handle objects in memory.\n\n - Scripting engine improperly handles objects in memory in microsoft browsers.\n\n - Chakra improperly discloses the contents of its memory.\n\n - Windows kernel improperly handles objects in memory.\n\n - Internet Explorer fails to validate User Mode Code Integrity (UMCI)\n policies.\n\n - Windows Hyper-V on a host server fails to properly validate vSMB packet\n data.\n\n - Chakra scripting engine handles objects in memory in Microsoft Edge.\n\n - Microsoft browsers improperly access objects in memory.\n\n - Windows Kernel API improperly enforces permissions.\n\n - Microsoft Edge improperly handles requests of different origins.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run processes in an elevated context, run arbitrary code in kernel mode,\n bypass security restrictions, gain the same user rights as the current user,\n disclose information to further compromise the user's computer or data,\n interrupt system functionality and also cause denial of service condition.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Windows 10 Version 1703 x32/x64.\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4103731\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath ){\n exit(0);\n}\n\nedgeVer = fetch_file_version(sysPath:sysPath, file_name:\"edgehtml.dll\");\nif(!edgeVer){\n exit(0);\n}\n\nif(version_in_range(version:edgeVer, test_version:\"11.0.15063.0\", test_version2:\"11.0.15063.1087\"))\n{\n report = report_fixed_ver(file_checked:sysPath + \"\\Edgehtml.dll\",\n file_version:edgeVer, vulnerable_range:\"11.0.15063.0 - 11.0.15063.1087\");\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-08T23:06:01", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-0959", "CVE-2018-0765", "CVE-2018-8174", "CVE-2018-0946", "CVE-2018-8134", "CVE-2018-0961", "CVE-2018-0854", "CVE-2018-8136", "CVE-2018-8126", "CVE-2018-0963", "CVE-2018-0824", "CVE-2018-8164", "CVE-2018-8178", "CVE-2018-8170", "CVE-2018-8132", "CVE-2018-1021", "CVE-2018-0955", "CVE-2018-8179", "CVE-2018-0951", "CVE-2018-0954", "CVE-2018-8127", "CVE-2018-8165", "CVE-2018-0953", "CVE-2018-8124", "CVE-2018-8112", "CVE-2018-8128", "CVE-2018-8123", "CVE-2018-8133", "CVE-2018-0958", "CVE-2018-8145", "CVE-2018-1039", "CVE-2018-8141", "CVE-2018-8897", "CVE-2018-8130", "CVE-2018-8122", "CVE-2018-8167", "CVE-2018-8166", "CVE-2017-11927", "CVE-2018-8129", "CVE-2018-0886", "CVE-2018-8137", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-0943", "CVE-2018-1025"], "description": "This host is missing a critical security\n update according to Microsoft KB4103727", "modified": "2020-06-04T00:00:00", "published": "2018-05-09T00:00:00", "id": "OPENVAS:1361412562310813346", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310813346", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4103727)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Microsoft Windows Multiple Vulnerabilities (KB4103727)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.813346\");\n script_version(\"2020-06-04T11:13:22+0000\");\n script_cve_id(\"CVE-2018-0765\", \"CVE-2018-0954\", \"CVE-2018-0955\", \"CVE-2018-0958\",\n \"CVE-2018-0959\", \"CVE-2018-0961\", \"CVE-2018-1021\", \"CVE-2018-1022\",\n \"CVE-2018-1025\", \"CVE-2018-1039\", \"CVE-2018-8112\", \"CVE-2018-8114\",\n \"CVE-2018-8122\", \"CVE-2018-8123\", \"CVE-2018-8124\", \"CVE-2018-8126\",\n \"CVE-2018-8127\", \"CVE-2018-8128\", \"CVE-2018-8129\", \"CVE-2018-8130\",\n \"CVE-2018-8132\", \"CVE-2018-8133\", \"CVE-2018-8134\", \"CVE-2018-8136\",\n \"CVE-2018-8137\", \"CVE-2018-8141\", \"CVE-2018-8145\", \"CVE-2018-8164\",\n \"CVE-2018-8165\", \"CVE-2018-8166\", \"CVE-2018-8167\", \"CVE-2018-8170\",\n \"CVE-2018-8174\", \"CVE-2018-8178\", \"CVE-2018-8179\", \"CVE-2018-8897\",\n \"CVE-2018-0824\", \"CVE-2018-0854\", \"CVE-2018-0943\", \"CVE-2018-0946\",\n \"CVE-2018-0951\", \"CVE-2018-0953\", \"CVE-2017-11927\", \"CVE-2018-0886\",\n \"CVE-2018-0963\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 11:13:22 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-05-09 11:45:30 +0530 (Wed, 09 May 2018)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4103727)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4103727\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaw exists due to,\n\n - Windows Common Log File System (CLFS) driver improperly handles objects\n in memory.\n\n - The Win32k component fails to properly handle objects in memory.\n\n - The DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects\n in memory.\n\n - Windows kernel fails to properly handle objects in memory.\n\n - Scripting engine improperly handles objects in memory in microsoft browsers.\n\n - Chakra improperly discloses the contents of its memory.\n\n - Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies.\n\n - Windows Hyper-V on a host server fails to properly validate vSMB packet data.\n\n - Windows Kernel API improperly enforces permissions.\n\n - Microsoft Edge improperly handles requests of different origins.\n\n - Windows Hyper-V on a host server fails to properly validate input from an\n authenticated user on a guest operating system.\n\n - An error in Credential Security Support Provider protocol (CredSSP).\n\n - Windows its:// protocol handler unnecessarily sends traffic to a remote\n site in order to determine the zone of a provided URL.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run processes in an elevated context, run arbitrary code in kernel mode,\n obtain information to further compromise the users system, bypass security\n restrictions, interrupt system and cause denial of service condition.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 10 Version 1709 for 32-bit Systems\n\n - Microsoft Windows 10 Version 1709 for 64-based Systems\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4103727\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath ){\n exit(0);\n}\n\nedgeVer = fetch_file_version(sysPath:sysPath, file_name:\"edgehtml.dll\");\nif(!edgeVer){\n exit(0);\n}\n\nif(version_in_range(version:edgeVer, test_version:\"11.0.16299.0\", test_version2:\"11.0.16299.430\"))\n{\n report = report_fixed_ver(file_checked:sysPath + \"\\Edgehtml.dll\",\n file_version:edgeVer, vulnerable_range:\"11.0.16299.0 - 11.0.16299.430\");\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "kaspersky": [{"lastseen": "2020-09-02T12:00:31", "bulletinFamily": "info", "cvelist": ["CVE-2018-0946", "CVE-2018-8126", "CVE-2018-8178", "CVE-2018-1021", "CVE-2018-0955", "CVE-2018-8179", "CVE-2018-0951", "CVE-2018-0954", "CVE-2018-0945", "CVE-2018-0953", "CVE-2018-8112", "CVE-2018-8128", "CVE-2018-8123", "CVE-2018-8133", "CVE-2018-8145", "CVE-2018-8130", "CVE-2018-8177", "CVE-2018-8122", "CVE-2018-8139", "CVE-2018-8137", "CVE-2018-1022", "CVE-2018-8114", "CVE-2018-0943", "CVE-2018-1025"], "description": "### *Detect date*:\n05/08/2018\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, bypass security restrictions.\n\n### *Affected products*:\nInternet Explorer 11 \nMicrosoft Edge (EdgeHTML-based) \nInternet Explorer 9 \nInternet Explorer 10 \nChakraCore\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2018-0943](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0943>) \n[CVE-2018-0945](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0945>) \n[CVE-2018-0946](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0946>) \n[CVE-2018-0951](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0951>) \n[CVE-2018-0953](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0953>) \n[CVE-2018-0954](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0954>) \n[CVE-2018-1021](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1021>) \n[CVE-2018-8123](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8123>) \n[CVE-2018-1022](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1022>) \n[CVE-2018-8130](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8130>) \n[CVE-2018-8178](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8178>) \n[CVE-2018-8128](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8128>) \n[CVE-2018-8133](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8133>) \n[CVE-2018-8114](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8114>) \n[CVE-2018-0955](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0955>) \n[CVE-2018-8139](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8139>) \n[CVE-2018-1025](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1025>) \n[CVE-2018-8112](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8112>) \n[CVE-2018-8145](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8145>) \n[CVE-2018-8126](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8126>) \n[CVE-2018-8137](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8137>) \n[CVE-2018-8122](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8122>) \n[CVE-2018-8179](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8179>) \n[CVE-2018-8177](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8177>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Internet Explorer](<https://threats.kaspersky.com/en/product/Microsoft-Internet-Explorer/>)\n\n### *CVE-IDS*:\n[CVE-2018-0943](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0943>)0.0Unknown \n[CVE-2018-0945](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0945>)0.0Unknown \n[CVE-2018-0946](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0946>)0.0Unknown \n[CVE-2018-0951](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0951>)0.0Unknown \n[CVE-2018-0953](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0953>)0.0Unknown \n[CVE-2018-0954](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0954>)0.0Unknown \n[CVE-2018-1021](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1021>)0.0Unknown \n[CVE-2018-8123](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8123>)0.0Unknown \n[CVE-2018-1022](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1022>)0.0Unknown \n[CVE-2018-8130](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8130>)0.0Unknown \n[CVE-2018-8178](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8178>)0.0Unknown \n[CVE-2018-8128](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8128>)0.0Unknown \n[CVE-2018-8133](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8133>)0.0Unknown \n[CVE-2018-8114](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8114>)0.0Unknown \n[CVE-2018-0955](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0955>)0.0Unknown \n[CVE-2018-8139](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8139>)0.0Unknown \n[CVE-2018-1025](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1025>)0.0Unknown \n[CVE-2018-8112](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8112>)0.0Unknown \n[CVE-2018-8145](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8145>)0.0Unknown \n[CVE-2018-8126](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8126>)0.0Unknown \n[CVE-2018-8137](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8137>)0.0Unknown \n[CVE-2018-8122](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8122>)0.0Unknown \n[CVE-2018-8179](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8179>)0.0Unknown \n[CVE-2018-8177](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8177>)0.0Unknown\n\n### *Microsoft official advisories*:\n\n\n### *KB list*:\n[4103723](<http://support.microsoft.com/kb/4103723>) \n[4103716](<http://support.microsoft.com/kb/4103716>) \n[4103731](<http://support.microsoft.com/kb/4103731>) \n[4103721](<http://support.microsoft.com/kb/4103721>) \n[4103730](<http://support.microsoft.com/kb/4103730>) \n[4103718](<http://support.microsoft.com/kb/4103718>) \n[4103727](<http://support.microsoft.com/kb/4103727>) \n[4103725](<http://support.microsoft.com/kb/4103725>) \n[4103768](<http://support.microsoft.com/kb/4103768>)\n\n### *Exploitation*:\nThe following public exploits exists for this vulnerability:", "edition": 34, "modified": "2020-07-22T00:00:00", "published": "2018-05-08T00:00:00", "id": "KLA11247", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11247", "title": "\r KLA11247Multiple vulnerabilities in Microsoft Browsers ", "type": "kaspersky", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}], "trendmicroblog": [{"lastseen": "2018-05-11T17:14:43", "bulletinFamily": "blog", "cvelist": ["CVE-2018-0765", "CVE-2018-0824", "CVE-2018-0854", "CVE-2018-0905", "CVE-2018-0943", "CVE-2018-0945", "CVE-2018-0946", "CVE-2018-0951", "CVE-2018-0953", "CVE-2018-0954", "CVE-2018-0955", "CVE-2018-0958", "CVE-2018-0959", "CVE-2018-0961", "CVE-2018-1021", "CVE-2018-1022", "CVE-2018-1025", "CVE-2018-1039", "CVE-2018-8112", "CVE-2018-8114", "CVE-2018-8119", "CVE-2018-8120", "CVE-2018-8122", "CVE-2018-8123", "CVE-2018-8124", "CVE-2018-8126", "CVE-2018-8127", "CVE-2018-8128", "CVE-2018-8129", "CVE-2018-8130", "CVE-2018-8132", "CVE-2018-8133", "CVE-2018-8134", "CVE-2018-8136", "CVE-2018-8137", "CVE-2018-8139", "CVE-2018-8145", "CVE-2018-8147", "CVE-2018-8148", "CVE-2018-8149", "CVE-2018-8150", "CVE-2018-8151", "CVE-2018-8152", "CVE-2018-8153", "CVE-2018-8154", "CVE-2018-8155", "CVE-2018-8156", "CVE-2018-8157", "CVE-2018-8158", "CVE-2018-8159", "CVE-2018-8160", "CVE-2018-8161", "CVE-2018-8162", "CVE-2018-8163", "CVE-2018-8164", "CVE-2018-8165", "CVE-2018-8166", "CVE-2018-8167", "CVE-2018-8168", "CVE-2018-8170", "CVE-2018-8173", "CVE-2018-8174", "CVE-2018-8177", "CVE-2018-8178", "CVE-2018-8179", "CVE-2018-8897"], "description": "\n\nThis week marked National Teacher Appreciation Week here in the United States. I was happy to see that many other countries celebrate educators in all the other months of the year. All of us have at least one teacher, instructor or professor who really made a difference in our lives. There are two for me, and while they may not remember me out of the thousands they taught over the years, I definitely remember them. The first one helped me realize that I could write, and had me focus my frustration through poetry and essays as a 10-year-old moving from a city of almost two million (at the time) to a small town with 3,000 people trying to fit in. The second one validated my love for writing and journalism in college, encouraged me to ask the tough questions (don\u2019t forget the five Ws and the H!) and reminded me to never bury the lead. He never forgave me for \u201cgoing to the dark side\u201d \u2013 that was _his_ definition for marketing \u2013 but told me that as long as I\u2019m still writing in some capacity, he was happy.\n\nIt\u2019s only fitting that during National Teach Appreciation week that the University of Texas at San Antonio announced its plans to open a new cybersecurity center for government agencies and businesses seeking future cybersecurity workers and research. The space may potentially host a startup incubator, a computing center for research, data visualization lab and other research and training facilities. With a predicted 3.5 million unfilled cybersecurity positions by the year 2021, according to the Cybersecurity Jobs Report 2018-2021, we need all the help we can get to stay ahead of sophisticated cyber threats. You can learn more about the new center [here](<https://www.utsa.edu/today/2018/04/story/NSCC.html>).\n\n**TippingPoint Operating System (TOS) v5.0.3**\n\nLate last week, we released TOS v5.0.3 build 4867 for the TippingPoint TX-Series devices (8200TX/8400TX). For a complete list of enhancements and changes, customers can refer to the product Release Notes located on the [Threat Management Center (TMC)](<https://tmc.tippingpoint.com/TMC/>) website. Customers with any concerns or questions can contact the Trend Micro TippingPoint Technical Assistance Center (TAC).\n\n**Microsoft Security Updates**\n\nThis week\u2019s Digital Vaccine\u00ae (DV) package includes coverage for Microsoft updates released on or before May 8, 2018. It was another busy month for Microsoft with 68 security patches covering Internet Explorer (IE), Edge, ChakraCore, Hyper-V Server, Windows, Visual Studio, Microsoft Office and Office Services and Web Apps, and the Azure IoT SDK. Of these 68 CVEs, 21 are listed as Critical, 45 are rated Important, and two are listed as Low in severity. Eleven of these CVEs came through the ZDI program. The following table maps Digital Vaccine filters to the Microsoft updates. You can get more detailed information on this month\u2019s security updates from Dustin Childs\u2019 [May 2018 Security Update Review](<https://www.zerodayinitiative.com/blog/2018/5/8/the-may-2018-security-update-review>) from the Zero Day Initiative:\n\n**CVE #** | **Digital Vaccine Filter #** | **Status** \n---|---|--- \nCVE-2018-0765 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-0824 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-0854 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-0905 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-0943 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-0945 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-0946 | 31487 | \nCVE-2018-0951 | 31488 | \nCVE-2018-0953 | 31489 | \nCVE-2018-0954 | 31490 | \nCVE-2018-0955 | 31563 | \nCVE-2018-0958 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-0959 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-0961 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-1021 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-1022 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-1025 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-1039 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8112 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8114 | 31491 | \nCVE-2018-8119 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8120 | 31562 | \nCVE-2018-8122 | 31492 | \nCVE-2018-8123 | 31552 | \nCVE-2018-8124 | 31558 | \nCVE-2018-8126 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8127 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8128 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8129 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8130 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8132 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8133 | 31494 | \nCVE-2018-8134 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8136 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8137 | 31617 | \nCVE-2018-8139 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8145 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8147 | 31554 | \nCVE-2018-8148 | 31555 | \nCVE-2018-8149 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8150 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8151 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8152 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8153 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8154 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8155 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8156 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8157 | 31556 | \nCVE-2018-8158 | 31557 | \nCVE-2018-8159 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8160 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8161 | 31573 | \nCVE-2018-8162 | 31559 | \nCVE-2018-8163 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8164 | 31561 | \nCVE-2018-8165 | 31571 | \nCVE-2018-8166 | 31572 | \nCVE-2018-8167 | 31560 | \nCVE-2018-8168 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8170 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8173 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8174 | 31493 | \nCVE-2018-8177 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8178 | | Vendor Deemed Reproducibility or Exploitation Unlikely \nCVE-2018-8179 | 31498 | \nCVE-2018-8897 | | Vendor Deemed Reproducibility or Exploitation Unlikely \n \n** **\n\n**Zero-Day Filters**\n\nThere are two new zero-day filters covering one vendor in this week\u2019s Digital Vaccine (DV) package. A number of existing filters in this week\u2019s DV package were modified to update the filter description, update specific filter deployment recommendation, increase filter accuracy and/or optimize performance. You can browse the list of [published advisories](<http://www.zerodayinitiative.com/advisories/published/>) and [upcoming advisories](<http://www.zerodayinitiative.com/advisories/upcoming/>) on the [Zero Day Initiative](<http://www.zerodayinitiative.com/>) website. You can also follow the Zero Day Initiative on Twitter [@thezdi](<https://twitter.com/thezdi>) and on their [blog](<https://www.zerodayinitiative.com/blog>).\n\n**_Trend Micro (2)_**\n\n| \n\n * 31495: ZDI-CAN-5550 Zero Day Initiative Vulnerability (Trend Micro Encryption for Email Gateway)\n * 31496: ZDI-CAN-5551 Zero Day Initiative Vulnerability (Trend Micro Encryption for Email Gateway) \n---|--- \n| \n \n**Missed Last Week\u2019s News?**\n\nCatch up on last week\u2019s news in my [weekly recap](<https://blog.trendmicro.com/tippingpoint-threat-intelligence-and-zero-day-coverage-week-of-april-30-2018/>).\n\nThe post [TippingPoint Threat Intelligence and Zero-Day Coverage \u2013 Week of May 7, 2018](<https://blog.trendmicro.com/tippingpoint-threat-intelligence-and-zero-day-coverage-week-of-may-7-2018/>) appeared first on [](<https://blog.trendmicro.com>).", "modified": "2018-05-11T15:37:20", "published": "2018-05-11T15:37:20", "id": "TRENDMICROBLOG:0CB92F2EE8EC7EB60BEEAFE3A0B1926F", "href": "https://blog.trendmicro.com/tippingpoint-threat-intelligence-and-zero-day-coverage-week-of-may-7-2018/", "type": "trendmicroblog", "title": "TippingPoint Threat Intelligence and Zero-Day Coverage \u2013 Week of May 7, 2018", "cvss": {"score": 0.0, "vector": "NONE"}}], "talosblog": [{"lastseen": "2018-06-23T08:19:16", "bulletinFamily": "blog", "cvelist": ["CVE-2018-0765", "CVE-2018-0824", "CVE-2018-0854", "CVE-2018-0943", "CVE-2018-0945", "CVE-2018-0946", "CVE-2018-0951", "CVE-2018-0953", "CVE-2018-0954", "CVE-2018-0955", "CVE-2018-0958", "CVE-2018-0959", "CVE-2018-0961", "CVE-2018-1021", "CVE-2018-1022", "CVE-2018-1025", "CVE-2018-1039", "CVE-2018-4944", "CVE-2018-8112", "CVE-2018-8114", "CVE-2018-8115", "CVE-2018-8119", "CVE-2018-8120", "CVE-2018-8122", "CVE-2018-8123", "CVE-2018-8124", "CVE-2018-8126", "CVE-2018-8127", "CVE-2018-8128", "CVE-2018-8129", "CVE-2018-8130", "CVE-2018-8132", "CVE-2018-8133", "CVE-2018-8134", "CVE-2018-8137", "CVE-2018-8139", "CVE-2018-8141", "CVE-2018-8145", "CVE-2018-8147", "CVE-2018-8148", "CVE-2018-8149", "CVE-2018-8150", "CVE-2018-8151", "CVE-2018-8152", "CVE-2018-8155", "CVE-2018-8156", "CVE-2018-8157", "CVE-2018-8158", "CVE-2018-8159", "CVE-2018-8160", "CVE-2018-8161", "CVE-2018-8162", "CVE-2018-8163", "CVE-2018-8164", "CVE-2018-8165", "CVE-2018-8166", "CVE-2018-8167", "CVE-2018-8170", "CVE-2018-8173", "CVE-2018-8174", "CVE-2018-8177", "CVE-2018-8178", "CVE-2018-8179", "CVE-2018-8897"], "description": "Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 67 new vulnerabilities, with 21 of them rated critical, 42 of them rated important, and four rated as low severity. These vulnerabilities impact Outlook, Office, Exchange, Edge, Internet Explorer and more.\n\n \n\n\nIn addition to the 67 vulnerabilities referenced above, Microsoft has also released a critical update advisory, [ADV180008](<https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV180008>), which addresses the vulnerability CVE-2018-4944 described in the Adobe security bulletin [APSB18-16](<http://helpx.adobe.com/security/products/flash-player/apsb18-16.html>).\n\n \n \n \n\n\n### Critical Vulnerabilities\n\nThis month, Microsoft is addressing 21 vulnerabilities that are rated as critical. Talos believes one of these is notable and requires prompt attention.\n\n \n\n\n[CVE-2018-8174](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174>) \\- Windows VBScript Engine Remote Code Execution Vulnerability.\n\nA remote code execution vulnerability exists in the VBScript scripting engine (vbscript.dll) of Windows. This vulnerability allows an attacker to include malicious VBScript within a website or embedded within an Office file, which when executed allows an attacker to execute arbitrary code in the context of the current user. Threat actors are currently exploiting this vulnerability.\n\n \n\n\nOther vulnerabilities rated as critical are listed below:\n\n \n\n\n[CVE-2018-0959](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0959>) \\- Hyper-V Remote Code Execution Vulnerability \n[CVE-2018-0961](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0961>) \\- Hyper-V vSMB Remote Code Execution Vulnerability \n[CVE-2018-8115](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8115>) \\- Windows Host Compute Service Shim Remote Code Execution Vulnerability \n[CVE-2018-8178](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8178>) \\- Microsoft Browser Memory Corruption Vulnerability \n[CVE-2018-0946](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0946>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-0951](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0951>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-0953](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0953>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-0954](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0954>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-0955](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0955>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-8114](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8114>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-8122](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8122>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-8137](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8137>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-0945](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0945>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-1022](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1022>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-8139](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8139>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-8128](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8128>) \\- Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-8133](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8133>) \\- Chakra Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-0943](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0943>) \\- Chakra Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-8130](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8130>) \\- Chakra Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-8177](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8177>) \\- Chakra Scripting Engine Memory Corruption Vulnerability\n\n \n\n\n### Important Vulnerabilities\n\n \n\n\nThis month, Microsoft is addressing 42 vulnerabilities that are rated important.\n\n \n\n\n[CVE-2018-8120](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120>) \\- Win32k Elevation of Privilege Vulnerability \n[CVE-2018-8123](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8123>) \\- Microsoft Edge Memory Corruption Vulnerability \n[CVE-2018-8124](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8124>) \\- Win32k Elevation of Privilege Vulnerability \n[CVE-2018-8147](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8147>) \\- Microsoft Excel Remote Code Execution Vulnerability \n[CVE-2018-8148](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8148>) \\- Microsoft Excel Remote Code Execution Vulnerability \n[CVE-2018-8157](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8157>) \\- Microsoft Office Remote Code Execution Vulnerability \n[CVE-2018-8158](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8158>) \\- Microsoft Office Remote Code Execution Vulnerability \n[CVE-2018-8161](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8161>) \\- Microsoft Office Remote Code Execution Vulnerability \n[CVE-2018-8162](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8162>) \\- Microsoft Excel Remote Code Execution Vulnerability \n[CVE-2018-8164](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8164>) \\- Win32k Elevation of Privilege Vulnerability \n[CVE-2018-8165](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8165>) \\- DirectX Graphics Kernel Elevation of Privilege Vulnerability \n[CVE-2018-8166](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8166>) \\- Win32k Elevation of Privilege Vulnerability \n[CVE-2018-8167](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8167>) \\- Windows Common Log File System Driver Elevation of Privilege Vulnerability \n[CVE-2018-8179](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8179>) \\- Microsoft Edge Memory Corruption Vulnerability \n[CVE-2018-0765](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0765>) \\- .NET and .NET Core Denial of Service Vulnerability \n[CVE-2018-0824](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0824>) \\- Microsoft COM for Windows Remote Code Execution Vulnerability \n[CVE-2018-0854](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0854>) \\- Windows Security Feature Bypass Vulnerability \n[CVE-2018-0958](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0958>) \\- Windows Security Feature Bypass Vulnerability \n[CVE-2018-1021](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1021>) \\- Microsoft Edge Information Disclosure Vulnerability \n[CVE-2018-1025](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1025>) \\- Microsoft Browser Information Disclosure Vulnerability \n[CVE-2018-1039](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1039>) \\- .NET Framework Device Guard Security Feature Bypass Vulnerability \n[CVE-2018-8112](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8112>) \\- Microsoft Edge Security Feature Bypass Vulnerability \n[CVE-2018-8119](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8119>) \\- Azure IoT SDK Spoofing Vulnerability \n[CVE-2018-8126](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8126>) \\- Internet Explorer Security Feature Bypass Vulnerability \n[CVE-2018-8127](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8127>) \\- Windows Kernel Information Disclosure Vulnerability \n[CVE-2018-8129](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8129>) \\- Windows Security Feature Bypass Vulnerability \n[CVE-2018-8132](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8132>) \\- Windows Security Feature Bypass Vulnerability \n[CVE-2018-8134](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8134>) \\- Windows Elevation of Privilege Vulnerability \n[CVE-2018-8141](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8141>) \\- Windows Kernel Information Disclosure Vulnerability \n[CVE-2018-8145](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8145>) \\- Chakra Scripting Engine Memory Corruption Vulnerability \n[CVE-2018-8149](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8149>) \\- Microsoft SharePoint Elevation of Privilege Vulnerability \n[CVE-2018-8150](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8150>) \\- Microsoft Outlook Security Feature Bypass Vulnerability \n[CVE-2018-8151](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8151>) \\- Microsoft Exchange Memory Corruption Vulnerability \n[CVE-2018-8152](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8152>) \\- Microsoft Exchange Server Elevation of Privilege Vulnerability \n[CVE-2018-8155](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8155>) \\- Microsoft SharePoint Elevation of Privilege Vulnerability \n[CVE-2018-8156](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8156>) \\- Microsoft SharePoint Elevation of Privilege Vulnerability \n[CVE-2018-8159](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8159>) \\- Microsoft Exchange Elevation of Privilege Vulnerability \n[CVE-2018-8160](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8160>) \\- Microsoft Outlook Information Disclosure Vulnerability \n[CVE-2018-8163](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8163>) \\- Microsoft Excel Information Disclosure Vulnerability \n[CVE-2018-8170](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8170>) \\- Windows Image Elevation of Privilege Vulnerability \n[CVE-2018-8173](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8173>) \\- Microsoft InfoPath Remote Code Execution Vulnerability \n[CVE-2018-8897](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897>) \\- Windows Kernel Elevation of Privilege Vulnerability\n\n \n\n\n### Coverage\n\nIn response to these vulnerability disclosures, Talos is releasing the following Snort rules that detect attempts to exploit them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up-to-date by downloading the latest rule pack available for purchase on Snort.org.\n\n \n\n\nSnort Rules:\n\n 46538 - 46539, \n 46544 - 46549, \n 46552 - 46565, \n 46594 - 46597, \n 46601 - 46604\n\n \n\n\n[](<http://feeds.feedburner.com/~ff/feedburner/Talos?a=Jg0FgcbhKyU:Y3ogHkaR8p0:yIl2AUoC8zA>)\n\n", "modified": "2018-05-09T08:42:37", "published": "2018-05-08T12:02:00", "id": "TALOSBLOG:C19AB95C902B2507E8156BE7B09BE73B", "href": "http://feedproxy.google.com/~r/feedburner/Talos/~3/Jg0FgcbhKyU/microsoft-patch-tuesday-may-2018.html", "type": "talosblog", "title": "Microsoft Patch Tuesday - May 2018", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}