Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute arbitrary code in the context of the current user, due to how Internet Explorer handles objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11822.

The Internet Explorer installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2017-11813,     CVE-2017-11822)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2017-11790)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2017-11793, CVE-2017-11810)

The remote Windows host is missing security update 4041687 or cumulative update 4041693. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory     via the Microsoft Windows Text Services Framework. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2017-8727)

  - A remote code execution vulnerability exists when     Windows Search handles objects in memory. An attacker     who successfully exploited this vulnerability could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2017-11771)

  - An elevation of privilege vulnerability exists when the     Windows Graphics Component improperly handles objects in     memory. An attacker who successfully exploited this     vulnerability could run processes in an elevated     context.  (CVE-2017-11824)

  - An elevation of privilege vulnerability exists when the     Windows kernel-mode driver fails to properly handle     objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2017-8689, CVE-2017-8694)

  - A buffer overflow vulnerability exists in the Microsoft     JET Database Engine that could allow remote code     execution on an affected system. An attacker who     successfully exploited this vulnerability could take     control of an affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2017-8717,     CVE-2017-8718)

  - An information disclosure vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory, allowing an attacker to     retrieve information from a targeted system. By itself,     the information disclosure does not allow arbitrary code     execution; however, it could allow arbitrary code to be     run if the attacker uses it in combination with another     vulnerability.  (CVE-2017-11816)

  - An information disclosure vulnerability exists in the     way that the Windows SMB Server handles certain     requests. An authenticated attacker who successfully     exploited this vulnerability could craft a special     packet, which could lead to information disclosure from     the server.  (CVE-2017-11815)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2017-11765, CVE-2017-11814)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2017-11793, CVE-2017-11810)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited the vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2017-11762,     CVE-2017-11763)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2017-11790)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2017-11817)

  - A denial of service vulnerability exists in the     Microsoft Server Block Message (SMB) when an attacker     sends specially crafted requests to the server. An     attacker who exploited this vulnerability could cause     the affected system to crash. To attempt to exploit this     issue, an attacker would need to send specially crafted     SMB requests to the target system. Note that the denial     of service vulnerability would not allow an attacker to     execute code or to elevate their user rights, but it     could cause the affected system to stop accepting     requests. The security update addresses the     vulnerability by correcting the manner in which SMB     handles specially crafted client requests.
    (CVE-2017-11781)

  - An elevation of privilege vulnerability exists when     Windows improperly handles calls to Advanced Local     Procedure Call (ALPC). An attacker who successfully     exploited this vulnerability could run arbitrary code in     the security context of the local system. An attacker     could then install programs; view, change, or delete     data; or create new accounts with full user rights.
    (CVE-2017-11783)

  - An Information disclosure vulnerability exists when     Windows Search improperly handles objects in memory. An     attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2017-11772)

  - An Security Feature bypass vulnerability exists in     Microsoft Windows storage when it fails to validate an     integrity-level check. An attacker who successfully     exploited the vulnerability could allow an application     with a certain integrity level to execute code at a     different integrity level. The update addresses the     vulnerability by correcting how Microsoft storage     validates an integrity-level check. (CVE-2017-11818)

  - A remote code execution vulnerability exists in the way     that the Microsoft Server Message Block 1.0 (SMBv1)     server handles certain requests. An attacker who     successfully exploited the vulnerability could gain the     ability to execute code on the target server.
    (CVE-2017-11780)

  - A remote code execution vulnerability     exists in Windows Domain Name System (DNS) DNSAPI.dll     when it fails to properly handle DNS responses. An     attacker who successfully exploited the vulnerability     could run arbitrary code in the context of the Local     System Account.  (CVE-2017-11779)

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2017-11813,     CVE-2017-11822)

  - An information disclosure vulnerability exists in the     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (ASLR) bypass. An attacker who     successfully exploited the vulnerability could retrieve     the memory address of a kernel object.  (CVE-2017-11784,     CVE-2017-11785)

  - A spoofing vulnerability exists in the Windows     implementation of wireless networking. An attacker who     successfully exploited this vulnerability could     potentially replay broadcast and/or multicast traffic     to hosts on a WPA or WPA 2-protected wireless network.
    (CVE-2017-13080)

The remote Windows host is missing security update 4041678 or cumulative update 4041681. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2017-11813,     CVE-2017-11822)

  - A remote code execution vulnerability exists when     Windows Search handles objects in memory. An attacker     who successfully exploited this vulnerability could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2017-11771)

  - An elevation of privilege vulnerability exists when the     Windows Graphics Component improperly handles objects in     memory. An attacker who successfully exploited this     vulnerability could run processes in an elevated     context.  (CVE-2017-11824)

  - An elevation of privilege vulnerability exists when the     Windows kernel-mode driver fails to properly handle     objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2017-8689, CVE-2017-8694)

  - A buffer overflow vulnerability exists in the Microsoft     JET Database Engine that could allow remote code     execution on an affected system. An attacker who     successfully exploited this vulnerability could take     control of an affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2017-8717,     CVE-2017-8718)

  - An information disclosure vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory, allowing an attacker to     retrieve information from a targeted system. By itself,     the information disclosure does not allow arbitrary code     execution; however, it could allow arbitrary code to be     run if the attacker uses it in combination with another     vulnerability.  (CVE-2017-11816)

  - An information disclosure vulnerability exists in the     way that the Windows SMB Server handles certain     requests. An authenticated attacker who successfully     exploited this vulnerability could craft a special     packet, which could lead to information disclosure from     the server.  (CVE-2017-11815)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2017-11765, CVE-2017-11814)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2017-11793, CVE-2017-11810)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited the vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2017-11762,     CVE-2017-11763)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2017-11790)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2017-11817)

  - A denial of service vulnerability exists in the     Microsoft Server Block Message (SMB) when an attacker     sends specially crafted requests to the server. An     attacker who exploited this vulnerability could cause     the affected system to crash. To attempt to exploit this     issue, an attacker would need to send specially crafted     SMB requests to the target system. Note that the denial     of service vulnerability would not allow an attacker to     execute code or to elevate their user rights, but it     could cause the affected system to stop accepting     requests. The security update addresses the     vulnerability by correcting the manner in which SMB     handles specially crafted client requests.
    (CVE-2017-11781)

  - An Information disclosure vulnerability exists when     Windows Search improperly handles objects in memory. An     attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2017-11772)

  - A remote code execution vulnerability exists in the way     that the Microsoft Server Message Block 1.0 (SMBv1)     server handles certain requests. An attacker who     successfully exploited the vulnerability could gain the     ability to execute code on the target server.
    (CVE-2017-11780)

  - An information disclosure vulnerability exists in the     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (ASLR) bypass. An attacker who     successfully exploited the vulnerability could retrieve     the memory address of a kernel object.  (CVE-2017-11784,     CVE-2017-11785)

  - A spoofing vulnerability exists in the Windows     implementation of wireless networking. An attacker who     successfully exploited this vulnerability could     potentially replay broadcast and/or multicast traffic     to hosts on a WPA or WPA 2-protected wireless network.
    (CVE-2017-13080)

ID	Name	Product	Family	Severity
104895	Security Updates for Internet Explorer (October 2017)	Nessus	Windows : Microsoft Bulletins	high
103750	Windows 8.1 and Windows Server 2012 R2 October 2017 Security Updates (KRACK)	Nessus	Windows : Microsoft Bulletins	critical
103746	Windows 7 and Windows Server 2008 R2 October 2017 Security Updates (KRACK)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2017-11813

high

Tenable Plugins

high

critical

critical