PT-2018-1311 · Google+3 · Google Chrome+5
Smgorelik
·
Publicado
2018-05-08
·
Atualizado
2025-10-28
·
CVE-2018-8174
CVSS v2.0
7.6
Alta
| Vetor | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows VBScript Engine versions prior to the fixed version
Description
A remote code execution issue exists in the way the VBScript engine handles objects in memory. This allows remote attackers to execute arbitrary code and affect the system. The vulnerability has been exploited in real-world incidents, including a malvertising campaign to deliver GandCrab ransomware. The campaign, known as Operation Earth Kitsune, involved exploiting the vulnerability to infect systems, which then communicated with attackers through GitHub and reported back through a closed Slack chat. The attackers also used 1-day vulnerabilities in Chrome and IE to spread malware.
Recommendations
For Microsoft Windows VBScript Engine versions prior to the fixed version, apply the official fix to resolve the issue. As a temporary workaround, consider restricting access to the VBScript engine or disabling it until a patch is available. Avoid using vulnerable API endpoints, such as
Wow64DisableWow64FsRedirection, ExitWindowsEx, ShellExecuteW, CreateProcessW, and CreateProcess, until the issue is resolved.Exploit
Correção
RCE
Buffer Overflow
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Google Chrome
Github
Ie
Slack
Vbscript Engine
Windows