PT-2018-1794 · Microsoft · Windows Server 2016+8

Omer Gull · Publicado 2018-11-13 · Atualizado 2020-02-13 · CVE-2018-8476

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Server versions prior to the fixed version Windows Server 2012 R2 Windows Server 2008 Windows Server 2012 Windows Server 2019 Windows Server 2016 Windows Server 2008 R2 Windows 10 Servers

Description A remote code execution issue exists due to the way the Windows Deployment Services TFTP Server handles objects in memory. This allows remote attackers to execute arbitrary code on the system by sending a specially crafted request. The vulnerability can be exploited by remote attackers, potentially leading to the execution of arbitrary code.

Recommendations For Windows Server 2012 R2, update to a version that includes the fix for this issue. For Windows Server 2008, consider applying a workaround or configuration change to mitigate the risk until a patch is available. For Windows Server 2012, restrict access to the TFTP Server until a patch is available. For Windows Server 2019, Windows Server 2016, Windows Server 2008 R2, and Windows 10 Servers, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the TFTP Server service until a patch is available.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2018-01394

CVE-2018-8476

Produtos afetados

Windows

Windows 10 Servers

Windows Deployment Services Tftp Server

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

Referências · 11

• https://research.checkpoint.com/2019/pxe-dust-finding-a-vulnerability-in-windows-servers-deployment-services · Nota
• https://bdu.fstec.ru/vul/2018-01394 · Nota de Segurança
• http://securityfocus.com/bid/105774 · Nota
• http://securitytracker.com/id/1042109 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8476 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8476 · Nota de Segurança
• https://securityfocus.com/bid/105774 · Nota
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8476 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-8476 · Nota de Segurança
• https://securitylab.ru/vulnerability/496452.php · Nota
• https://osv.dev/vulnerability/CVE-2018-8476 · Aviso do Fabricante