PT-2018-1878 · Microsoft · Windows 10+8

Published 2018-11-13 · Updated 2021-09-30 · CVE-2018-8256

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows RT 8.1 PowerShell Core versions 6.0 through 6.1 Microsoft.PowerShell.Archive version 1.2.2.0 Windows Server versions 2008 R2 through 2019 Windows 7 Windows 8.1 Windows 10 Windows 10 Servers

Description A remote code execution issue exists due to improper handling of specially crafted files by PowerShell. This allows remote attackers to execute arbitrary code on the system. The vulnerability is related to errors in processing objects in memory, which can be exploited by using a specially crafted file.

Recommendations For Windows RT 8.1, update to a newer version that contains a fix for this issue. For PowerShell Core versions 6.0 through 6.1, update to a newer version that contains a fix for this issue. For Microsoft.PowerShell.Archive version 1.2.2.0, update to a newer version that contains a fix for this issue. For Windows Server versions 2008 R2 through 2019, update to a newer version that contains a fix for this issue. For Windows 7, Windows 8.1, Windows 10, and Windows 10 Servers, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to PowerShell until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2018-01480

CVE-2018-8256

Affected Products

Microsoft.Powershell.Archive

Powershell

Powershell Core

Windows

Windows 10

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server

References · 10

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8256 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8256 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8256 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01480 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8256 · Security Note
• http://securityfocus.com/bid/105781 · Note
• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-8256 · Note
• http://securitytracker.com/id/1042108 · Note
• https://securitylab.ru/vulnerability/496462.php · Note