Kaspersky LabKLA11896KLA11896 Multiple vulnerabilities in Microsoft Products (ESU)
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.6 High
AI Score
Confidence
High
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.652 Medium
EPSS
Percentile
97.8%
Detect date:
04/10/2018
Severity:
Critical
Description:
Multiple vulnerabilities were found in Microsoft Products (Extended Support Update). Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, gain privileges, cause denial of service.
Exploitation:
Public exploits exist for this vulnerability.
Affected products:
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows 10 for 32-bit Systems
Windows Server, version 1803 (Server Core Installation)
Internet Explorer 9
Windows 10 for x64-based Systems
Windows Server 2012 (Server Core installation)
Windows Server 2016 (Server Core installation)
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows Server 2012
Windows Server 2008 for 32-bit Systems Service Pack 2
Internet Explorer 11
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2016
Windows 10 Version 1709 for x64-based Systems
Windows RT 8.1
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows 10 Version 1703 for x64-based Systems
Windows Server 2012 R2 (Server Core installation)
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows 10 Version 1511 for 32-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows 10 Version 1803 for x64-based Systems
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows 10 Version 1511 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Internet Explorer 10
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1703 for 32-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2012 R2
Windows 10 Version 1803 for 32-bit Systems
Solution:
Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories:
CVE-2018-1020
CVE-2018-1004
CVE-2018-0987
CVE-2018-1008
CVE-2018-0981
CVE-2018-0969
CVE-2018-0967
CVE-2018-1001
CVE-2018-1000
CVE-2018-0989
CVE-2018-0988
CVE-2018-0960
CVE-2018-0887
CVE-2018-8116
CVE-2018-0996
CVE-2018-1015
CVE-2018-1016
CVE-2018-1010
CVE-2018-1012
CVE-2018-1013
CVE-2018-0970
CVE-2018-0971
CVE-2018-0972
CVE-2018-0973
CVE-2018-0974
CVE-2018-0975
CVE-2018-0976
CVE-2018-1003
Impacts:
ACE
Related products:
CVE-IDS:
CVE-2018-08875.5High
CVE-2018-09605.5High
CVE-2018-09675.3High
CVE-2018-09695.5High
CVE-2018-09705.5High
CVE-2018-09715.5High
CVE-2018-09725.5High
CVE-2018-09735.5High
CVE-2018-09745.5High
CVE-2018-09755.5High
CVE-2018-09765.3High
CVE-2018-10037.8Critical
CVE-2018-10048.8Critical
CVE-2018-10087.0High
CVE-2018-10108.8Critical
CVE-2018-10128.8Critical
CVE-2018-10138.8Critical
CVE-2018-10158.8Critical
CVE-2018-10168.8Critical
CVE-2018-81165.5High
CVE-2018-09815.3High
CVE-2018-10005.3High
CVE-2018-10017.5Critical
CVE-2018-10207.5Critical
CVE-2018-09887.5Critical
CVE-2018-09874.3Warning
CVE-2018-09894.3Warning
CVE-2018-09967.5Critical
KB list:
4093478
4093224
4093227
4093223
4093108
4093118
4093257
4091756
4092946
Microsoft official advisories:
References
support.microsoft.com/kb/4091756
support.microsoft.com/kb/4092946
support.microsoft.com/kb/4093108
support.microsoft.com/kb/4093118
support.microsoft.com/kb/4093223
support.microsoft.com/kb/4093224
support.microsoft.com/kb/4093227
support.microsoft.com/kb/4093257
support.microsoft.com/kb/4093478
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0887
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0960
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0967
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0969
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0970
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0971
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0972
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0973
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0974
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0975
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0976
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0981
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0987
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0988
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0989
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0996
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1001
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1003
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1004
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1008
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1010
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1012
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1013
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1015
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1016
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1020
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8116
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0887
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0960
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0967
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0969
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0970
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0971
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0972
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0973
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0974
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0975
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0976
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0981
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0987
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0988
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0989
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-0996
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1000
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1001
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1003
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1004
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1008
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1010
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1012
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1013
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1015
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1016
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-1020
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2018-8116
portal.msrc.microsoft.com/en-us/security-guidance
statistics.securelist.com/vulnerability-scan/month
threats.kaspersky.com/en/class/Exploit/
threats.kaspersky.com/en/product/Microsoft-Internet-Explorer/
threats.kaspersky.com/en/product/Microsoft-Windows-10/
threats.kaspersky.com/en/product/Microsoft-Windows-7/
threats.kaspersky.com/en/product/Microsoft-Windows-8/
threats.kaspersky.com/en/product/Microsoft-Windows-Server-2008/
threats.kaspersky.com/en/product/Microsoft-Windows-Server-2012/
threats.kaspersky.com/en/product/Microsoft-Windows-Server/
threats.kaspersky.com/en/product/Microsoft-Windows/
threats.kaspersky.com/en/product/Windows-RT/
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.6 High
AI Score
Confidence
High
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.652 Medium
EPSS
Percentile
97.8%