Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA11789
HistoryAug 14, 2018 - 12:00 a.m.

KLA11789 Multiple vulnerabilities in Microsoft Products (ESU)

2018-08-1400:00:00
Kaspersky Lab
threats.kaspersky.com
16

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.932 High

EPSS

Percentile

99.0%

JSON

Detect date:

08/14/2018

Severity:

Critical

Description:

Multiple vulnerabilities were found in Microsoft Products (Eextended Support Update). Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information.

Exploitation:

Public exploits exist for this vulnerability.

Affected products:

Windows 10 Version 1803 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows Server 2012 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows 10 Version 1709 for x64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server, version 1803 (Server Core Installation)
Windows 10 Version 1703 for 32-bit Systems
Windows Server 2012 R2
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1803 for 32-bit Systems
Windows Server 2016 (Server Core installation)
Windows Server, version 1709 (Server Core Installation)
Internet Explorer 9
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 8.1 for 32-bit systems
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows 10 Version 1703 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 8.1 for x64-based systems
Windows Server 2008 for x64-based Systems Service Pack 2
Windows 10 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2012
ChakraCore
Windows RT 8.1
Microsoft Edge (EdgeHTML-based)
Internet Explorer 10
Windows Server 2016
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows 7 for x64-based Systems Service Pack 1
Internet Explorer 11
Windows Server 2012 R2 (Server Core installation)
Windows 7 for 32-bit Systems Service Pack 1

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2018-8344
CVE-2018-8397
CVE-2018-8385
CVE-2018-8346
CVE-2018-8404
CVE-2018-8398
CVE-2018-8349
CVE-2018-8348
CVE-2018-8394
CVE-2018-8389
CVE-2018-8396
CVE-2018-8353
CVE-2018-8343
CVE-2018-8342
CVE-2018-8341
CVE-2018-8339
CVE-2018-8373
CVE-2018-8345
CVE-2018-8371
ADV180018

Impacts:

ACE

Related products:

Microsoft Internet Explorer

CVE-IDS:

CVE-2018-83857.6Critical
CVE-2018-83537.6Critical
CVE-2018-83897.6Critical
CVE-2018-83717.6Critical
CVE-2018-83737.6Critical
CVE-2018-83457.6Critical
CVE-2018-83499.3Critical
CVE-2018-83984.3Warning
CVE-2018-83481.9Warning
CVE-2018-83396.9High
CVE-2018-83437.2High
CVE-2018-83944.3Warning
CVE-2018-83469.3Critical
CVE-2018-84047.2High
CVE-2018-83979.3Critical
CVE-2018-83961.9Warning
CVE-2018-83411.9Warning
CVE-2018-83427.2High
CVE-2018-83449.3Critical

KB list:

4343899
4343900
4343205
4344104
4340937
4341832
4343674
4340939
4338380
4457984
4458010

Microsoft official advisories:

References

Related

openvas 7
mskb 17
nessus 10
cve 24
prion 24
attackerkb 5
github 6
osv 8
veracode 2
kaspersky 2
thn 1
talosblog 1
krebs 1
qualysblog 1
mscve 19
symantec 15
checkpoint_advisories 9
zdi 7
zdt 1
cisa_kev 1
threatpost 2
myhack58 4
googleprojectzero 1
malwarebytes 2
securelist 1
openvas
openvas
Microsoft Windows Multiple Vulnerabilities (KB4343900)
2018-08-15 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB4343898)
2018-08-15 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB4343892)
2018-08-15 00:00:00
mskb
mskb
August 14, 2018—KB4343899 (Security-only update)
2018-08-14 07:00:00
August 14, 2018—KB4343901 (Monthly Rollup)
2018-08-14 07:00:00
August 14, 2018—KB4343896 (Security-only update)
2018-08-14 07:00:00
nessus
nessus
Security Updates for Windows Server 2008 (August 2018) (Foreshadow)
2018-08-14 00:00:00
KB4343899: Windows 7 and Windows Server 2008 R2 August 2018 Security Update (Foreshadow)
2018-08-14 00:00:00
KB4343896: Windows Server 2012 August 2018 Security Update (Foreshadow)
2018-08-14 00:00:00
cve
cve
CVE-2018-8394
2018-08-15 17:29:00
CVE-2018-8396
2018-08-15 17:29:00
CVE-2018-8398
2018-08-15 17:29:00
prion
prion
Information disclosure
2018-08-15 17:29:00
Information disclosure
2018-08-15 17:29:00
Information disclosure
2018-08-15 17:29:00
attackerkb
attackerkb
CVE-2018-8373
2018-08-15 00:00:00
CVE-2018-8385
2018-08-15 00:00:00
CVE-2018-8389
2018-08-15 00:00:00
github
github
ChakraCore RCE Vulnerability
2022-05-13 01:20:49
ChakraCore RCE Vulnerability
2022-05-13 01:20:51
ChakraCore RCE Vulnerability
2022-05-13 01:20:49
osv
osv
ChakraCore RCE Vulnerability
2022-05-13 01:20:51
CVE-2018-8385
2018-08-15 17:29:08
ChakraCore RCE Vulnerability
2022-05-13 01:20:48
veracode
veracode
Remote Code Execution (RCE)
2018-08-16 09:38:32
Remote Code Execution (RCE)
2018-08-16 04:17:50
kaspersky
kaspersky
KLA11309 Multiple vulnerabilities in Microsoft Windows
2018-08-14 00:00:00
KLA11306 Multiple vulnerabilities in Microsoft Browsers
2018-08-14 00:00:00
thn
thn
Microsoft Releases Patches for 60 Flaws—Two Under Active Attack
2018-08-14 18:32:00
talosblog
talosblog
Microsoft Tuesday August 2018
2018-08-14 11:26:00
krebs
krebs
Patch Tuesday, August 2018 Edition
2018-08-15 14:52:21
qualysblog
qualysblog
August Patch Tuesday – 63 Vulns, L1TF (Foreshadow), Exchange, SQL, Active Attacks on IE flaw
2018-08-14 18:47:21
mscve
mscve
LNK Remote Code Execution Vulnerability
2018-08-14 07:00:00
Windows NDIS Elevation of Privilege Vulnerability
2018-08-14 07:00:00
Windows NDIS Elevation of Privilege Vulnerability
2018-08-14 07:00:00
symantec
symantec
Microsoft Windows NDIS CVE-2018-8342 Local Privilege Escalation Vulnerability
2018-08-14 00:00:00
Microsoft Windows GDI+ Component CVE-2018-8397 Remote Code Execution Vulnerability
2018-08-14 00:00:00
Microsoft Windows Graphics Component CVE-2018-8344 Remote Code Execution Vulnerability
2018-08-14 00:00:00
checkpoint_advisories
checkpoint_advisories
Microsoft Graphics Remote Code Execution (CVE-2018-8344)
2018-08-14 00:00:00
Microsoft Graphics Component Information Disclosure (CVE-2018-8396)
2019-02-21 00:00:00
Microsoft Graphics Device Interface Remote Code Execution (CVE-2018-8397)
2022-09-18 00:00:00
zdi
zdi
Microsoft Windows Font Subsetting Integer Overflow Remote Code Execution Vulnerability
2018-08-14 00:00:00
Microsoft Windows LNK File Uninitialized Pointer Information Disclosure Vulnerability
2018-08-14 00:00:00
Microsoft Windows EMF File Out-Of-Bounds Read Information Disclosure Vulnerability
2018-08-30 00:00:00
zdt
zdt
Microsoft Windows - JScript RegExp.lastIndex Use-After-Free Exploit
2018-08-28 00:00:00
cisa_kev
cisa_kev
Microsoft Scripting Engine Memory Corruption Vulnerability
2022-03-25 00:00:00
threatpost
threatpost
Patch Tuesday: Microsoft Addresses Two Zero-Days in 60-Flaw Roundup
2018-08-14 20:42:41
Darkhotel Exploits Microsoft Zero-Day VBScript Flaw
2018-08-20 16:39:26
myhack58
myhack58
From BinDiff to 0day: Internet Explorer UAF vulnerability analysis-vulnerability warning-the black bar safety net
2019-09-17 00:00:00
Use CVE-2018-8373 0day vulnerabilities the attacks the Darkhotel gang-related analysis-vulnerability warning-the black bar safety net
2018-08-18 00:00:00
For a suspected CVE-2016-0189 the original attack sample debugging-vulnerability warning-the black bar safety net
2019-06-13 00:00:00
googleprojectzero
googleprojectzero
On VBScript
2018-12-19 00:00:00
malwarebytes
malwarebytes
A week in security (September 24 – 30)
2018-10-01 16:44:20
Buggy implementation of CVE-2018-8373 vulnerability used to deliver Quasar RAT
2018-09-26 17:13:26
securelist
securelist
IT threat evolution Q3 2018. Statistics
2018-11-12 10:00:55

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.932 High

EPSS

Percentile

99.0%

JSON
Related for KLA11789
openvas7mskb17nessus10cve24prion24attackerkb5github6osv8veracode2kaspersky2thn1talosblog1krebs1qualysblog1mscve19symantec15checkpoint_advisories9zdi7zdt1cisa_kev1threatpost2myhack584googleprojectzero1malwarebytes2securelist1