PT-2018-2108 · Microsoft · Windows Server 2016+11

Alex Ionescu · Published 2018-12-11 · Updated 2020-08-24 · CVE-2018-8514

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers

Description An information disclosure issue exists due to improper initialization of objects in memory by the Remote Procedure Call runtime. This could allow an attacker to disclose protected information using a specially crafted application. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided.

Recommendations For Windows 7, update to a newer version to mitigate the risk. For Windows Server 2012 R2, apply the recommended configuration changes. For Windows RT 8.1, restrict access to sensitive information. For Windows Server 2008, disable unnecessary features. For Windows Server 2019, update to a newer version to mitigate the risk. For Windows Server 2012, apply the recommended configuration changes. For Windows 8.1, restrict access to sensitive information. For Windows Server 2016, update to a newer version to mitigate the risk. For Windows Server 2008 R2, disable unnecessary features. For Windows 10, update to a newer version to mitigate the risk. For Windows 10 Servers, apply the recommended configuration changes. As a temporary workaround, consider restricting access to sensitive information until a patch is available.

Fix

Improper Initialization

Buffer Overflow

Weakness Enumeration

CWE-665

CWE-119

Related Identifiers

BDU:2019-00059

CVE-2018-8514

Affected Products

Windows

Windows 10

Windows 10 Servers

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

References · 8

• https://osv.dev/vulnerability/CVE-2018-8514 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8514 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8514 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8514 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8514 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00059 · Security Note
• https://aha.org/system/files/2019-01/tpl-white-flash-jan-2-2019--ab-000102-mw.pdf · Note
• http://securityfocus.com/bid/106079 · Note