PT-2018-1812 · Microsoft · Windows Server 2019+2

Published 2018-11-13 · Updated 2019-10-03 · CVE-2018-8592

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows 10 version 1809 Windows Server 2019

Description The issue is related to errors in the installation procedure of the Windows operating system from physical media, such as USB or DVD. Exploitation of this issue may allow an attacker to elevate their privileges using the "keep nothing" option during the installation process. This affects Windows 10 and Windows Server 2019.

Recommendations For Windows 10 version 1809, consider applying the necessary security updates to resolve the issue. For Windows Server 2019, apply the relevant security patches to fix the vulnerability. As a temporary workaround, restrict the use of physical media for installation and consider alternative installation methods until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2018-01412

CVE-2018-8592

Affected Products

Windows

Windows 10

Windows Server 2019

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2018-8592 · Security Note
• https://bdu.fstec.ru/vul/2018-01412 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8592 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8592 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8592 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8592 · Vendor Advisory
• http://securityfocus.com/bid/105809 · Note
• https://securitylab.ru/vulnerability/496463.php · Note
• https://rapid7.com/db/vulnerabilities/msft-cve-2018-8592 · Note
• http://securitytracker.com/id/1042126 · Note