PT-2018-1809 · Microsoft · Windows Server 2016+8

Igor Glucksmann · Publicado 2018-11-13 · Atualizado 2019-10-03 · CVE-2018-8549

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Windows Server 2012 R2 Windows RT 8.1 Windows Server 2012 Windows Server 2019 Windows Server 2016 Windows 8.1 Windows 10 Windows 10 Servers

Description A security feature bypass exists due to incorrect validation of kernel driver signatures by Windows. This issue is related to errors in the kernel driver authentication mechanism, which can allow an attacker to load incorrectly signed drivers into the kernel.

Recommendations For Windows Server 2012 R2, update the operating system to a version that includes the security patch for this issue. For Windows RT 8.1, apply the recommended configuration changes to mitigate the risk of exploitation. For Windows Server 2012, consider disabling the loading of kernel drivers until a patch is available. For Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, and Windows 10 Servers, apply the necessary security updates to resolve the issue. As a temporary workaround, consider restricting access to the kernel driver loading mechanism to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

BDU:2018-01409

CVE-2018-8549

Produtos afetados

Windows

Windows 10

Windows 10 Servers

Windows 8.1

Windows Rt 8.1

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

Referências · 10

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8549 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-8549 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-01409 · Nota de Segurança
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8549 · Aviso do Fabricante
• https://rapid7.com/db/vulnerabilities/msft-cve-2018-8549 · Nota
• http://securityfocus.com/bid/105803 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8549 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-8549 · Aviso do Fabricante
• https://securitylab.ru/vulnerability/496468.php · Nota
• http://securitytracker.com/id/1042138 · Nota