PT-2018-1794 · Microsoft · Windows Server 2016+8

Omer Gull · Published 2018-11-13 · Updated 2020-02-13 · CVE-2018-8476

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Server versions prior to the fixed version Windows Server 2012 R2 Windows Server 2008 Windows Server 2012 Windows Server 2019 Windows Server 2016 Windows Server 2008 R2 Windows 10 Servers

Description A remote code execution issue exists due to the way the Windows Deployment Services TFTP Server handles objects in memory. This allows remote attackers to execute arbitrary code on the system by sending a specially crafted request. The vulnerability can be exploited by remote attackers, potentially leading to the execution of arbitrary code.

Recommendations For Windows Server 2012 R2, update to a version that includes the fix for this issue. For Windows Server 2008, consider applying a workaround or configuration change to mitigate the risk until a patch is available. For Windows Server 2012, restrict access to the TFTP Server until a patch is available. For Windows Server 2019, Windows Server 2016, Windows Server 2008 R2, and Windows 10 Servers, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the TFTP Server service until a patch is available.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2018-01394

CVE-2018-8476

Affected Products

Windows

Windows 10 Servers

Windows Deployment Services Tftp Server

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

References · 11

• https://bdu.fstec.ru/vul/2018-01394 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8476 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8476 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8476 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8476 · Vendor Advisory
• https://research.checkpoint.com/2019/pxe-dust-finding-a-vulnerability-in-windows-servers-deployment-services · Note
• http://securityfocus.com/bid/105774 · Note
• http://securitytracker.com/id/1042109 · Note
• https://securityfocus.com/bid/105774 · Note
• https://securitylab.ru/vulnerability/496452.php · Note