PT-2018-18497 · Microsoft · Windows Server 2016+2

Published 2018-06-12 · Updated 2019-10-03 · CVE-2018-8226

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Windows Server 2016 Windows 10 Windows 10 Servers

Description A denial of service issue exists due to improper parsing of specially crafted HTTP 2.0 requests in the HTTP.sys protocol stack. This allows attackers to affect the system.

Recommendations For Windows Server 2016, update the HTTP.sys protocol stack to a version that properly handles HTTP 2.0 requests. For Windows 10, update the HTTP.sys protocol stack to a version that properly handles HTTP 2.0 requests. For Windows 10 Servers, update the HTTP.sys protocol stack to a version that properly handles HTTP 2.0 requests.

Fix

Related Identifiers

CVE-2018-8226

Affected Products

Windows

Windows 10

Windows Server 2016

References · 7

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8226 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8226 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8226 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-8226 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8226 · Vendor Advisory
• http://securityfocus.com/bid/104361 · Note
• http://securitytracker.com/id/1041094 · Note