SB2017091218 - Multiple vulnerabilities in Microsoft Windows Hyper-V
Published: September 12, 2017
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2017-8704)
The vulnerability allows an adjacent attacker to cause DoS condition on the host system.
The vulnerability exists in Microsoft Hyper-V Virtual PCI on a host server due to an improper input validation. An adjacent attacker can run a specially crafted application and cause a host machine to crash.
Successful exploitation of the vulnerability results in denial of service.
2) Information disclosure (CVE-ID: CVE-2017-8706)
The vulnerability allows an adjacent attacker to obtain potential sensitive information on the host system.
The vulnerability exists in Microsoft Hyper-V on a host server due to an improper input validation. An adjacent attacker can run a specially crafted application and cause the Hyper-V host operating system to disclose memory information.
3) Information disclosure (CVE-ID: CVE-2017-8707)
The vulnerability allows an adjacent attacker to obtain potential sensitive information on the host system.
The vulnerability exists in Microsoft Hyper-V on a host server due to an improper input validation. An adjacent attacker can run a specially crafted application and cause the Hyper-V host operating system to disclose memory information.
4) Information disclosure (CVE-ID: CVE-2017-8711)
The vulnerability allows an adjacent attacker to obtain potential sensitive information on the host system.
The vulnerability exists in Microsoft Hyper-V on a host server due to an improper input validation. An adjacent attacker can run a specially crafted application and cause the Hyper-V host operating system to disclose memory information.
5) Information disclosure (CVE-ID: CVE-2017-8712)
The vulnerability allows an adjacent attacker to obtain potential sensitive information on the host system.
The vulnerability exists in Microsoft Hyper-V on a host server due to an improper input validation. An adjacent attacker can run a specially crafted application and cause the Hyper-V host operating system to disclose memory information.
6) Information disclosure (CVE-ID: CVE-2017-8713)
The vulnerability allows an adjacent attacker to obtain potential sensitive information on the host system.
The vulnerability exists in Microsoft Hyper-V on a host server due to an improper input validation. An adjacent attacker can run a specially crafted application and cause the Hyper-V host operating system to disclose memory information.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8704
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8706
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8707
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8711
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8712
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8713