PT-2018-2089 · Microsoft · Windows Server 2016+11

Lucas Leong + 3 · Published 2018-05-08 · Updated 2020-09-28 · CVE-2018-8423

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft JET Database Engine (affected versions not specified) Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers

Description A remote code execution issue exists due to insufficient input validation in the Microsoft JET Database Engine. This allows an attacker to execute arbitrary code and gain control of the vulnerable system by using a specially crafted file. The vulnerability can be exploited by remote attackers, affecting the system.

Recommendations For Windows 7, consider applying the recommended security updates. For Windows Server 2012 R2, apply the latest security patches. For Windows RT 8.1, restrict access to the JET Database Engine until a fix is available. For Windows Server 2008, update to the latest service pack. For Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, and Windows 10 Servers, apply the relevant security updates from Microsoft. As a temporary workaround, consider disabling the JET Database Engine functionality until a patch is available. Restrict access to the vulnerable system to minimize the risk of exploitation.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-20

CWE-119

Related Identifiers

BDU:2019-00040

CVE-2018-8423

ZDI-18-1075

Affected Products

Jet Database Engine

Windows

Windows 10

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

References · 10

• 🔥 https://blog.0patch.com/2018/10/patching-re-patching-and-meta-patching.html · Exploit
• 🔥 https://blog.0patch.com/2018/09/outrunning-attackers-on-jet-database.html · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8423 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8423 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8423 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8423 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-18-1075 · Security Note
• https://bdu.fstec.ru/vul/2019-00040 · Security Note
• http://securitytracker.com/id/1041837 · Note