PT-2018-1268 · Microsoft · Windows Server 2016+11

Yuki Chen · Published 2018-04-10 · Updated 2020-08-24 · CVE-2018-1004

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows 7 Windows Server 2012 R2 Internet Explorer 9 Windows RT 8.1 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10

Description A remote code execution issue exists due to the way the VBScript engine handles objects in memory. This could allow an attacker to execute arbitrary code in the context of the current user by corrupting memory. If the current user has administrative rights, an attacker could take control of the affected system, install programs, view or modify data, or create new accounts with full user rights. The vulnerability can be exploited through a specially crafted web page or document.

Recommendations For Windows 7, consider applying security updates to address the issue. For Windows Server 2012 R2, apply the latest security patches to mitigate the risk. For Internet Explorer 9, update to a newer version of Internet Explorer or apply relevant security updates. For Windows RT 8.1, Windows Server 2012, Windows 8.1, Windows Server 2016, and Windows Server 2008 R2, ensure all security updates are installed to protect against this issue. For Windows 10, apply the latest Windows updates to resolve the vulnerability.

Fix

RCE

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2018-00744

CVE-2018-1004

ZDI-18-291

Affected Products

Internet Explorer

Internet Explorer 9

Vbscript

Windows

Windows 10

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

References · 9

• https://zerodayinitiative.com/advisories/ZDI-18-291 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1004 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1004 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-1004 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1004 · Security Note
• https://bdu.fstec.ru/vul/2018-00744 · Security Note
• http://securityfocus.com/bid/103657 · Note
• http://securitytracker.com/id/1040655 · Note