Multiple vulnerabilities in Windows kernel



Risk High
Patch available YES
Number of vulnerabilities 11
CVE-ID CVE-2018-0810
CVE-2018-0829
CVE-2018-0830
CVE-2018-0831
CVE-2018-0832
CVE-2018-0843
CVE-2018-0742
CVE-2018-0756
CVE-2018-0809
CVE-2018-0820
CVE-2018-0757
CWE-ID CWE-200
CWE-264
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Windows Server
Operating systems & Components / Operating system

Windows
Operating systems & Components / Operating system

Vendor Microsoft

Security Bulletin

This security bulletin contains information about 11 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU10531

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-0810

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.

The vulnerability exists due to improper initialization of a memory address by the Windows kernel. A remote attacker can run a specially crafted application, gain access to potentially sensitive information and perform further attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows Server: 2008 - 2012

Windows: 7

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0810


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU10532

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-0829

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.

The vulnerability exists due to improper handling of memory by the Windows kernel. A remote attacker can run a specially crafted application, gain access to potentially sensitive information and perform further attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 7 - 10

Windows Server: 2008 - 2016 10.0.14393.10

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0829


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU10533

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-0830

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.

The vulnerability exists due to improper handling of memory by the Windows kernel. A remote attacker can run a specially crafted application, gain access to potentially sensitive information and perform further attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 7 - 10

Windows Server: 2008 - 2016 10.0.14393.10

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0830


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Privilege escalation

EUVDB-ID: #VU10534

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-0831

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges.

The vulnerability exists due to improper handling of memory by the Windows kernel. A local attacker can run a specially crafted application, trigger memory corruption and execute arbitrary code with system privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 10

Windows Server: 2016 10.0.14393.10

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0831


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU10535

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-0832

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.

The vulnerability exists due to improper handling of a memory address by the Windows kernel. A remote attacker can run a specially crafted application, retrieve the memory address of a kernel object and bypass Kernel Address Space Layout Randomization (ASLR).

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 8.1 - 10

Windows Server: 2012 R2 - 2016 10.0.14393.10

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0832


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Information disclosure

EUVDB-ID: #VU10538

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-0843

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.

The vulnerability exists due to improper initialization of a memory address by the Windows kernel. A remote attacker can run a specially crafted application, gain access to potentially sensitive information and perform further attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 10

Windows Server: 2016 10.0.14393.10

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0843


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Privilege escalation

EUVDB-ID: #VU10541

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-0742

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges.

The vulnerability exists due to improper handling of memory by the Windows kernel. A local attacker can run a specially crafted application, trigger memory corruption and execute arbitrary code with system privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 7 - 10

Windows Server: 2008 - 2016 10.0.14393.10

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0742


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Privilege escalation

EUVDB-ID: #VU10544

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-0756

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges.

The vulnerability exists due to improper handling of memory by the Windows kernel. A local attacker can run a specially crafted application, trigger memory corruption and execute arbitrary code with system privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 10

Windows Server: 2016 10.0.14393.10

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0756


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Privilege escalation

EUVDB-ID: #VU10546

Risk: High

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-0809

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to gain elevated privileges.

The vulnerability exists due to improper handling of memory by the Windows kernel. A remote attacker can run a specially crafted application, trigger memory corruption and execute arbitrary code with system privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 10

Windows Server: 2016 10.0.14393.10

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0809


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Privilege escalation

EUVDB-ID: #VU10548

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-0820

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges.

The vulnerability exists due to improper handling of memory by the Windows kernel. A local attacker can run a specially crafted application, trigger memory corruption and execute arbitrary code with system privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 7 - 10

Windows Server: 2008 - 2016 10.0.14393.10

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0820


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Information disclosure

EUVDB-ID: #VU10550

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-0757

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.

The vulnerability exists due to improper initialization of a memory address by the Windows kernel. A remote attacker can run a specially crafted application, gain access to potentially sensitive information and perform further attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 7 - 10

Windows Server: 2008 - 2016 10.0.14393.10

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0757


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###