PT-2018-1878 · Microsoft · Windows 10+8

Publicado 2018-11-13 · Atualizado 2021-09-30 · CVE-2018-8256

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows RT 8.1 PowerShell Core versions 6.0 through 6.1 Microsoft.PowerShell.Archive version 1.2.2.0 Windows Server versions 2008 R2 through 2019 Windows 7 Windows 8.1 Windows 10 Windows 10 Servers

Description A remote code execution issue exists due to improper handling of specially crafted files by PowerShell. This allows remote attackers to execute arbitrary code on the system. The vulnerability is related to errors in processing objects in memory, which can be exploited by using a specially crafted file.

Recommendations For Windows RT 8.1, update to a newer version that contains a fix for this issue. For PowerShell Core versions 6.0 through 6.1, update to a newer version that contains a fix for this issue. For Microsoft.PowerShell.Archive version 1.2.2.0, update to a newer version that contains a fix for this issue. For Windows Server versions 2008 R2 through 2019, update to a newer version that contains a fix for this issue. For Windows 7, Windows 8.1, Windows 10, and Windows 10 Servers, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to PowerShell until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2018-01480

CVE-2018-8256

Produtos afetados

Microsoft.Powershell.Archive

Powershell

Powershell Core

Windows

Windows 10

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server

Referências · 10

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8256 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-8256 · Nota de Segurança
• http://securityfocus.com/bid/105781 · Nota
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8256 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-8256 · Aviso do Fabricante
• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-8256 · Nota
• https://bdu.fstec.ru/vul/2018-01480 · Nota de Segurança
• http://securitytracker.com/id/1042108 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8256 · Nota de Segurança
• https://securitylab.ru/vulnerability/496462.php · Nota