PT-2018-1796 · Microsoft · Windows Server 2016+11

Laith Al-Satari · Publicado 2018-11-13 · Atualizado 2019-10-03 · CVE-2018-8562

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers

Description The issue is related to an elevation of privilege vulnerability in the Win32k component of Windows, which fails to properly handle objects in memory. This can allow an attacker to elevate their privileges and potentially execute arbitrary code in kernel mode using a specially crafted application. The vulnerability can be exploited to affect the system.

Recommendations For Windows 7, consider applying security updates or patches to address the issue. For Windows Server 2012 R2, apply the latest security updates to resolve the vulnerability. For Windows RT 8.1, install the latest available patches to fix the issue. For Windows Server 2008, update to the latest service pack and apply security patches. For Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, and Windows 10 Servers, apply the latest security updates or patches to address the vulnerability. As a temporary workaround, consider restricting access to the Win32k component until a patch is available.

Correção

LPE

Improper Resource Release

Enumeração de Fraquezas

CWE-264

CWE-404

Identificadores relacionados

BDU:2018-01396

CVE-2018-8562

Produtos afetados

Windows

Windows 10

Windows 10 Servers

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

Referências · 10

• https://osv.dev/vulnerability/CVE-2018-8562 · Aviso do Fabricante
• https://vuldb.com/?id.126736 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8562 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-8562 · Nota de Segurança
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8562 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8562 · Nota de Segurança
• https://securitylab.ru/vulnerability/496451.php · Nota
• https://cybersecurity-help.cz/vdb/SB2018111319 · Nota
• http://securityfocus.com/bid/105790 · Nota
• https://bdu.fstec.ru/vul/2018-01396 · Nota de Segurança