PT-2018-1791 · Microsoft · Windows Server 2016+11

Ivan Fratric + 1 · Published 2018-11-13 · Updated 2018-12-17 · CVE-2018-8544

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers

Description A remote code execution issue exists due to the way the VBScript engine handles objects in memory. This can be exploited by remote attackers to execute arbitrary code, potentially through a specially crafted web page or Microsoft Office document. The vulnerability is caused by a buffer overflow in the VBScript engine.

Recommendations For Windows 7, apply the relevant patch to fix the VBScript engine issue. For Windows Server 2012 R2, update the VBScript engine to prevent remote code execution. For Windows RT 8.1, apply the security update to address the buffer overflow vulnerability. For Windows Server 2008, install the patch to fix the remote code execution issue in the VBScript engine. For Windows Server 2019, update the system to include the fix for the VBScript engine vulnerability. For Windows Server 2012, apply the security update to prevent exploitation of the VBScript engine issue. For Windows 8.1, install the patch to address the remote code execution vulnerability. For Windows Server 2016, update the system to include the fix for the VBScript engine issue. For Windows Server 2008 R2, apply the relevant patch to fix the VBScript engine vulnerability. For Windows 10, update the system to prevent remote code execution through the VBScript engine. For Windows 10 Servers, install the security update to address the VBScript engine issue.

Exploit

Fix

RCE

Use After Free

Buffer Overflow

Weakness Enumeration

CWE-416

CWE-119

Related Identifiers

BDU:2018-01391

CVE-2018-8544

ZDI-18-1349

Affected Products

Vbscript

Windows

Windows 10

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

References · 13

• 🔥 https://exploit-db.com/exploits/45923 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-18-1349 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8544 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8544 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8544 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8544 · Security Note
• https://bdu.fstec.ru/vul/2018-01391 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8544 · Vendor Advisory
• https://securityfocus.com/bid/105787 · Note
• http://securityfocus.com/bid/105787 · Note
• https://securitylab.ru/vulnerability/496456.php · Note
• http://securitytracker.com/id/1042118 · Note
• https://cybersecurity-help.cz/vdb/SB2018111323 · Note