PT-2018-2600 · Microsoft · Windows Server 2016+12

Guyio · Publicado 2018-10-09 · Atualizado 2018-11-28 · CVE-2018-8494

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services versions prior to the fixed version Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers

Description The issue is related to the incorrect restriction of XML links to external objects in Microsoft XML Core Services. This can be exploited by a remote attacker using a specially crafted web page, potentially allowing the execution of arbitrary code. The vulnerability affects various Windows operating systems and can be exploited remotely.

Recommendations For Windows 7, consider applying the relevant security patch to fix the issue. For Windows Server 2012 R2, apply the security update to resolve the vulnerability. For Windows RT 8.1, install the latest security patch to mitigate the risk. For Windows Server 2008, apply the recommended fix to address the issue. For Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, and Windows 10 Servers, update to the latest version or apply the relevant security patch to fix the vulnerability. As a temporary workaround, consider restricting the use of the MSXML parser until a patch is available.

Correção

RCE

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2019-01088

CVE-2018-8494

Produtos afetados

Xml Core Services

Windows

Windows 10

Windows 10 Servers

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

Referências · 8

• https://osv.dev/vulnerability/CVE-2018-8494 · Aviso do Fabricante
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8494 · Aviso do Fabricante
• http://securitytracker.com/id/1041844 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8494 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8494 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-01088 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-8494 · Nota de Segurança
• http://securityfocus.com/bid/105457 · Nota