A kernel-mode driver in Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows 8 allows an elevation of privilege when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE is unique from CVE-2017-0263.

The remote Windows host is missing a security update. It is, therefore, affected by one or more of the following vulnerabilities :

  - A remote code execution vulnerability exists in how the     Remote Desktop Protocol (RDP) handles requests if the     RDP server has Smart Card authentication enabled. An     authenticated, remote attacker can exploit this, via a     specially crafted application, to execute arbitrary code     with full user privileges. (CVE-2017-0176)

  - A remote code execution vulnerability exists in     Microsoft Internet Explorer due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by convincing a user to visit a     specially crafted website, to execute arbitrary code in     the context of the current user. (CVE-2017-0222)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0267)

  - A buffer overflow condition exists in the IIS WebDAV     service due to improper handling of the 'If' header in a     PROPFIND request. An unauthenticated, remote attacker     can exploit this, via a specially crafted request, to     cause a denial of service condition or the execution of     arbitrary code. This vulnerability, also known as     EXPLODINGCAN, is one of multiple Equation Group     vulnerabilities and exploits disclosed on 2017/04/14 by     a group known as the Shadow Brokers. (CVE-2017-7269)

  - A remote code execution vulnerability exists in how the     Remote Desktop Protocol (RDP) handles requests if the     RDP server has Routing and Remote Access enabled. An     authenticated, remote attacker can exploit this, via a     specially crafted application, to execute arbitrary code     with full user privileges. (CVE-2017-8461)

  - A remote code execution vulnerability exists in Windows     OLE, specifically in olecnv32.dll, due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a specially crafted website or to open a     specially crafted file or email, to execute arbitrary     code in the context of the current user. (CVE-2017-8487)

  - A remote code execution vulnerability exists in the     Windows Search functionality due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, via a specially crafted SMB message,     to execute arbitrary code. (CVE-2017-8543)

  - An information disclosure vulnerability exists in the     GDI component due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     this, by convincing a user to open a specially crafted     document or visit a specially crafted website, to     disclose the contents of memory. (CVE-2017-8552)

The remote Windows Vista host is missing a security update. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists in     Microsoft Internet Explorer due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by convincing a user to visit a     specially crafted website, to execute arbitrary code in     the context of the current user. (CVE-2017-0222)

  - Multiple information disclosure vulnerabilities exist in     the Microsoft Server Message Block 1.0 (SMBv1) server     when handling certain requests. An unauthenticated,     remote attacker can exploit these, via a specially     crafted packet, to disclose sensitive information.
    (CVE-2017-0267, CVE-2017-0268, CVE-2017-0270,     CVE-2017-0271, CVE-2017-0274, CVE-2017-0275,     CVE-2017-0276)

  - Multiple denial of service vulnerabilities exist in     Microsoft Server Message Block (SMB) when handling a     specially crafted request to the server. An     unauthenticated, remote attacker can exploit these, via     a crafted SMB request, to cause the system to stop     responding. (CVE-2017-0269, CVE-2017-0273,     CVE-2017-0280)

  - Multiple remote code execution vulnerabilities exist in     the Microsoft Server Message Block 1.0 (SMBv1) server     when handling certain requests. An unauthenticated,     remote attacker can exploit these, via a specially     crafted packet, to execute arbitrary code on a target     server. (CVE-2017-0272, CVE-2017-0277, CVE-2017-0278,     CVE-2017-0279)

  - A remote code execution vulnerability exists in Windows     due to improper handling of shortcuts. An     unauthenticated, remote attacker can exploit this, by     convincing a user to insert a removable drive containing     a malicious shortcut and binary, to automatically     execute arbitrary code in the context of the current     user. (CVE-2017-8464)

  - A remote code execution vulnerability exists in the     Windows Search functionality due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, via a specially crafted SMB message,     to execute arbitrary code. (CVE-2017-8543)

  - An information disclosure vulnerability exists in the     GDI component due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     this, by convincing a user to open a specially crafted     document or visit a specially crafted website, to     disclose the contents of memory. (CVE-2017-8552)

The remote Windows host is missing multiple security updates released on 2017/05/09. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists when the     Windows improperly handles objects in memory.
    (CVE-2017-0077)

  - A denial of service vulnerability exists in Windows DNS     Server if the server is configured to answer version     queries. An attacker who successfully exploited this     vulnerability could cause the DNS Server service to     become nonresponsive. (CVE-2017-0171)

   - An information disclosure vulnerability exists in the     way that the Windows Graphics Device Interface+ (GDI+)     handles objects in memory, allowing an attacker to     retrieve information from a targeted system.
    (CVE-2017-0190)

  - An elevation of privilege vulnerability exists in the     Windows COM Aggregate Marshaler due to an unspecified     flaw. A local attacker can exploit this, via a specially     crafted application, to execute arbitrary code with     elevated privileges. (CVE-2017-0213)

  - An elevation of privilege vulnerability exists in     Windows due to improper validation of user-supplied     input when loading type libraries. A local attacker can     exploit this, via a specially crafted application, to     gain elevated privileges. (CVE-2017-0214)

  - An information disclosure vulnerability exists in the     Windows kernel due to improper handling of objects in     memory. A local attacker can exploit this, via a     specially crafted application, to disclose sensitive     information. (CVE-2017-0175, CVE-2017-0220)

  - An information disclosure vulnerability exists in the     way some ActiveX objects are instantiated. An attacker     who successfully exploited this vulnerability could gain     access to protected memory contents.  (CVE-2017-0242)

  - An elevation of privilege vulnerability exists in the     way that the Windows Kernel handles objects in memory.
    An attacker who successfully exploited the vulnerability     could execute code with elevated permissions. On systems     with Windows 7 for x64-based Systems or later installed,     this vulnerability can lead to denial of service.
    (CVE-2017-0244)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2017-0245)

  - An elevation of privilege vulnerability exists when     Windows improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context. On computers     with Windows 7 for x64-based systems or later installed,     this vulnerability can lead to denial of service.
    (CVE-2017-0246)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2017-0258)

  - An elevation of privilege vulnerability exists in     Windows when the Windows kernel-mode driver fails to     properly handle objects in memory.
    (CVE-2017-0263)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0267)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0268)

  - A denial of service vulnerability exists in Microsoft     Server Message Block (SMB) when handling a specially     crafted request to the server. An unauthenticated,     remote attacker can exploit this, via a crafted SMB     request, to cause the system to stop responding.
    (CVE-2017-0269)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0270)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0271)

  - A remote code execution vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to execute arbitrary code on a target server.
    (CVE-2017-0272)

  - A denial of service vulnerability exists in Microsoft     Server Message Block (SMB) when handling a specially     crafted request to the server. An unauthenticated,     remote attacker can exploit this, via a crafted SMB     request, to cause the system to stop responding.
    (CVE-2017-0273)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0274)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0275)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0276)

  - A remote code execution vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to execute arbitrary code on a target server.
    (CVE-2017-0277)

  - A remote code execution vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to execute arbitrary code on a target server.
    (CVE-2017-0278)

  - A remote code execution vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to execute arbitrary code on a target server.
    (CVE-2017-0279)

  - A denial of service vulnerability exists in Microsoft     Server Message Block (SMB) when handling a specially     crafted request to the server. An unauthenticated,     remote attacker can exploit this, via a crafted SMB     request, to cause the system to stop responding.
    (CVE-2017-0280)

  - An information disclosure vulnerability exists in the     GDI component due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     this, by convincing a user to open a specially crafted     document or visit a specially crafted website, to     disclose the contents of memory. (CVE-2017-8552)

The remote Windows host is missing security update 4019263 or cumulative update 4019264. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in the Windows     DNS server when it's configured to answer version     queries. An unauthenticated, remote attacker can exploit     this, via a malicious DNS query, to cause the DNS server     to become nonresponsive. (CVE-2017-0171)

  - An information disclosure vulnerability exists in the     Windows kernel due to improper handling of objects in     memory. A local attacker can exploit this, via a     specially crafted application, to disclose sensitive     information. (CVE-2017-0175)

  - An elevation of privilege vulnerability exists in the     Windows COM Aggregate Marshaler due to an unspecified     flaw. A local attacker can exploit this, via a specially     crafted application, to execute arbitrary code with     elevated privileges. (CVE-2017-0213)

  - An elevation of privilege vulnerability exists in     Windows due to improper validation of user-supplied     input when loading type libraries. A local attacker can     exploit this, via a specially crafted application, to     gain elevated privileges. (CVE-2017-0214)

  - An information disclosure vulnerability exists in the     Windows kernel due to improper handling of objects in     memory. A local attacker can exploit this, via a     specially crafted application, to disclose sensitive     information. (CVE-2017-0220)

  - A remote code execution vulnerability exists in     Microsoft Internet Explorer due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by convincing a user to visit a     specially crafted website, to execute arbitrary code in     the context of the current user. (CVE-2017-0222)

  - A spoofing vulnerability exists in Microsoft browsers     due to improper rendering of the SmartScreen filter. An     unauthenticated, remote attacker can exploit this, via a     specially crafted URL, to redirect users to a malicious     website that appears to be a legitimate website.
    (CVE-2017-0231)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0267)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0268)

  - A denial of service vulnerability exists in Microsoft     Server Message Block (SMB) when handling a specially     crafted request to the server. An unauthenticated,     remote attacker can exploit this, via a crafted SMB     request, to cause the system to stop responding.
    (CVE-2017-0269)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0270)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0271)

  - A remote code execution vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to execute arbitrary code on a target server.
    (CVE-2017-0272)

  - A denial of service vulnerability exists in Microsoft     Server Message Block (SMB) when handling a specially     crafted request to the server. An unauthenticated,     remote attacker can exploit this, via a crafted SMB     request, to cause the system to stop responding.
    (CVE-2017-0273)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0274)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0275)

  - An information disclosure vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to disclose sensitive information.
    (CVE-2017-0276)

  - A remote code execution vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to execute arbitrary code on a target server.
    (CVE-2017-0277)

  - A remote code execution vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to execute arbitrary code on a target server.
    (CVE-2017-0278)

  - A remote code execution vulnerability exists in the     Microsoft Server Message Block 1.0 (SMBv1) server when     handling certain requests. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet, to execute arbitrary code on a target server.
    (CVE-2017-0279)

  - A denial of service vulnerability exists in Microsoft     Server Message Block (SMB) when handling a specially     crafted request to the server. An unauthenticated,     remote attacker can exploit this, via a crafted SMB     request, to cause the system to stop responding.
    (CVE-2017-0280)

  - An information disclosure vulnerability exists in the     GDI component due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     this, by convincing a user to open a specially crafted     document or visit a specially crafted website, to     disclose the contents of memory. (CVE-2017-8552)

ID	Name	Product	Family	Severity
100791	Microsoft Security Advisory 4025685: Guidance for older platforms (XP / 2003) (EXPLODINGCAN)	Nessus	Windows : Microsoft Bulletins	critical
100785	Microsoft Security Advisory 4025685: Windows Vista (June 2017)	Nessus	Windows : Microsoft Bulletins	critical
100063	Windows 2008 May 2017 Multiple Security Updates	Nessus	Windows : Microsoft Bulletins	high
100058	Windows 7 and Windows Server 2008 R2 May 2017 Security Updates	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2017-8552

high

Tenable Plugins

critical

critical

high

high