Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows improperly handling calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability".

The remote Windows host is missing security update 4025338.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Windows Search handles objects in memory. An attacker     who successfully exploited this vulnerability could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2017-8589)

  - A remote code execution vulnerability exists in the way     that the VBScript engine, when rendered in Internet     Explorer, handles objects in memory. In a web-based     attack scenario, an attacker could host a specially     crafted website that is designed to exploit this     vulnerability through Internet Explorer and then     convince a user to view the website. An attacker could     also embed an ActiveX control marked &quot;safe for     initialization in an application or Microsoft     Office document that hosts the Internet Explorer     rendering engine. The attacker could also take advantage     of compromised websites and websites that accept or host     user-provided content or advertisements. These websites     could contain specially crafted content that could     exploit this vulnerability. An attacker who successfully     exploited this vulnerability could gain the same user     rights as the current user.  (CVE-2017-8618)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2017-8467, CVE-2017-8556,     CVE-2017-8573, CVE-2017-8577, CVE-2017-8578,     CVE-2017-8580)

  - A Denial Of Service vulnerability exists when Windows     Explorer attempts to open a non-existent file. An     attacker who successfully exploited this vulnerability     could cause a denial of service. A attacker could     exploit this vulnerability by hosting a specially     crafted web site and convince a user to browse to the     page, containing the reference to the non-existing file,     and cause the victim's system to stop responding. An     attacker could not force a user to view the attacker-     controlled content. Instead, an attacker would have to     convince a user to take action. For example, an attacker     could trick a user into clicking a link that takes the     user to the attacker's site The update addresses the     vulnerability by correcting how Windows Explorer handles     open attempts for non-existent files. (CVE-2017-8587)

  - A remote code execution vulnerability exists in the way     JavaScript engines render when handling objects in     memory in Microsoft browsers. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2017-8606, CVE-2017-8607,     CVE-2017-8608)

  - A security feature bypass vulnerability exists in     Microsoft Windows when Kerberos fails to prevent     tampering with the SNAME field during ticket exchange.
    An attacker who successfully exploited this     vulnerability could use it to bypass Extended Protection     for Authentication.  (CVE-2017-8495)

  - A remote code execution vulnerability exists in the way     that the Scripting Engine renders when handling objects     in memory in Microsoft browsers. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user.  (CVE-2017-8609)

  - An elevation of privilege vulnerability exists in the     way that the Windows Kernel handles objects in memory.
    An attacker who successfully exploited the vulnerability     could execute code with elevated permissions.
    (CVE-2017-8561)

  - A remote code execution vulnerability exists in     PowerShell when PSObject wraps a CIM Instance. An     attacker who successfully exploited this vulnerability     could execute malicious code on a vulnerable system. In     an attack scenario, an attacker could execute malicious     code in a PowerShell remote session. The update     addresses the vulnerability by correcting how PowerShell     deserializes user supplied scripts. (CVE-2017-8565)

  - An elevation of privilege vulnerability exists when     Windows improperly handles calls to Advanced Local     Procedure Call (ALPC). An attacker who successfully     exploited this vulnerability could run arbitrary code in     the security context of the local system. An attacker     could then install programs; view, change, or delete     data; or create new accounts with full user rights.
    (CVE-2017-8562)

  - An information disclosure vulnerability exists in     Microsoft Windows when Win32k fails to properly handle     objects in memory. An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2017-8486)

  - An information disclosure vulnerability exists in the     Windows Performance Monitor Console when it improperly     parses XML input containing a reference to an external     entity. An attacker who successfully exploited this     vulnerability could read arbitrary files via an XML     external entity (XXE) declaration.  (CVE-2017-0170)

  - A remote code execution vulnerability exists in the way     Microsoft Edge handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2017-8595, CVE-2017-8605,     CVE-2017-8619)

  - An elevation of privilege vulnerability exists when the     Windows Common Log File System (CLFS) driver improperly     handles objects in memory.  (CVE-2017-8590)

  - An information disclosure vulnerability exists when the     Windows kernel fails to properly initialize a memory     address, allowing an attacker to retrieve information     that could lead to a Kernel Address Space Layout     Randomization (KASLR) bypass. An attacker who     successfully exploited this vulnerability could retrieve     the base address of the kernel driver from a compromised     process.  (CVE-2017-8564)

  - A security feature bypass vulnerability exists when     Microsoft Browsers improperly handle redirect requests.
    This vulnerability allows Microsoft Browsers to bypass     CORS redirect restrictions and to follow redirect     requests that should otherwise be ignored. An attacker     who successfully exploited this vulnerability could     force the browser to send data that would otherwise be     restricted to a destination web site of their choice.
    (CVE-2017-8592)

  - An Information Disclosure vulnerability exists when the     HTTP.sys server application component improperly handles     objects in memory. An attacker who successfully     exploited this vulnerability could obtain information to     further compromise the HTTP.sys server application     system. A remote unauthenticated attacker could exploit     this vulnerability by issuing a request to the HTTP.sys     server application. The update addresses the     vulnerability by correcting how the HTTP.sys server     application handles objects in memory. (CVE-2017-8582)

  - A spoofing vulnerability exists when an affected     Microsoft browser does not properly parse HTTP content.
    An attacker who successfully exploited this     vulnerability could trick a user by redirecting the user     to a specially crafted website. The specially crafted     website could either spoof content or serve as a pivot     to chain an attack with other vulnerabilities in web     services.  (CVE-2017-8602)

  - A denial of service vulnerability exists when Microsoft     Common Object Runtime Library improperly handles web     requests. An attacker who successfully exploited this     vulnerability could cause a denial of service against a     .NET web application. A remote unauthenticated attacker     could exploit this vulnerability by issuing specially     crafted requests to the .NET application. The update     addresses the vulnerability by correcting how the .NET     web application handles web requests. (CVE-2017-8585)

  - An elevation of privilege vulnerability exists when     Windows improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context.
    (CVE-2017-8581)

  - An elevation of privilege vulnerability exists in     Microsoft Windows when a man-in-the-middle attacker is     able to successfully forward an authentication request     to a Windows LDAP server, such as a system running     Active Directory Domain Services (AD DS) or Active     Directory Lightweight Directory Services (AD LDS), which     has been configured to require signing or sealing on     incoming connections. The update addresses this     vulnerability by incorporating support for Extended     Protection for Authentication security feature, which     allows the LDAP server to detect and block such     forwarded authentication requests once enabled.
    (CVE-2017-8563)

  - A spoofing vulnerability exists when Microsoft Edge     improperly handles specific HTML content. An attacker     who successfully exploited this vulnerability could     trick a user into believing that the user was on a     legitimate website. The specially crafted website could     either spoof content or serve as a pivot to chain an     attack with other vulnerabilities in web services.
    (CVE-2017-8611)

  - A security feature bypass vulnerability exists when     Microsoft Edge fails to correctly apply Same Origin     Policy for HTML elements present in other browser     windows. An attacker could use this vulnerability to     trick a user into loading a page with malicious content.
    (CVE-2017-8599)

  - A remote code execution vulnerability exists in the way     that Microsoft WordPad parses specially crafted files.
    Exploitation of this vulnerability requires that a user     open a specially crafted file with an affected version     of Microsoft WordPad.  (CVE-2017-8588)

  - A remote code execution vulnerability exists when     Windows Explorer improperly handles executable files and     shares during rename operations. An attacker who     successfully exploited this vulnerability could run     arbitrary code in the context of another user. Users not     running as administrators would be less affected.
    (CVE-2017-8463)

  - A remote code execution vulnerability exists in the way     that Microsoft browser JavaScript engines render content     when handling objects in memory. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. In a web-based attack scenario, an attacker could     host a specially crafted website that is designed to     exploit the vulnerability through Microsoft browsers and     then convince a user to view the website. An attacker     could also embed an ActiveX control marked &quot;safe     for initialization&quot; in an application or Microsoft     Office document that hosts the related rendering engine.
    The attacker could also take advantage of compromised     websites, and websites that accept or host user-provided     content or advertisements. These websites could contain     specially crafted content that could exploit the     vulnerability. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2017-8601)

  - An information disclosure vulnerability exists in the     Windows System Information Console when it improperly     parses XML input containing a reference to an external     entity. An attacker who successfully exploited this     vulnerability could read arbitrary files via an XML     external entity (XXE) declaration.  (CVE-2017-8557)

The remote Windows host is missing security update 4025343 or cumulative update 4025331. It is, therefore, affected by multiple vulnerabilities :


  - An information disclosure vulnerability exists in the     Windows Performance Monitor Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to create a     Data Collector Set and import a specially crafted XML     file, to disclose arbitrary files via an XML external     entity (XXE) declaration. (CVE-2017-0170)

   - A remote code execution vulnerability exists in Windows     Explorer due to improper handling of executable files     and shares during rename operations. An unauthenticated,     remote attacker can exploit this, by convincing a user     to open a specially crafted file, to execute arbitrary     code in the context of the current user. (CVE-2017-8463)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8467)

  - An information disclosure vulnerability exists in Win32k     due to improper handling of objects in memory. A local     attacker can exploit this, via a specially crafted     application, to disclose sensitive information.
    (CVE-2017-8486)

  - A security bypass vulnerability exists in Microsoft     Windows when handling Kerberos ticket exchanges due to a     failure to prevent tampering with the SNAME field. A     man-in-the-middle attacker can exploit this to bypass     the Extended Protection for Authentication security     feature. (CVE-2017-8495)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8556)

  - An information disclosure vulnerability exists in the     Windows System Information Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to open a     specially crafted file, to disclose arbitrary files via     an XML external entity (XXE) declaration.
    (CVE-2017-8557)

  - An elevation of privilege vulnerability exists in the     Windows kernel due to improper handling of objects in     memory. A local attacker can exploit this, via a     specially crafted application, to execute arbitrary code     with elevated permissions. (CVE-2017-8561)

  - An elevation of privilege vulnerability exists in the     Windows due to improper handling of calls to Advanced     Local Procedure Call (ALPC). An authenticated, remote     attacker can exploit this via a specially crafted     application, to run processes in an elevated context.
    (CVE-2017-8562)

  - An elevation of privilege vulnerability exists in     Windows due to Kerberos falling back to NT LAN Manager     (NTLM) Authentication Protocol as the default     authentication protocol. An authenticated, remote     attacker can exploit this, via an application that     sends specially crafted traffic to a domain controller,     to run processes in an elevated context. (CVE-2017-8563)

  - An information disclosure vulnerability exists in the     Windows kernel due to improper initialization of objects     in memory. An authenticated, remote attacker can exploit     this, via a specially crafted application, to bypass     Kernel Address Space Layout Randomization (KASLR) and     disclose the base address of the kernel driver.
    (CVE-2017-8564)

  - A remote code execution vulnerability exists in     PowerShell when handling a PSObject that wraps a CIM     instance. An authenticated, remote attacker can exploit     this, via a specially crafted script, to execute     arbitrary code in a PowerShell remote session.
    (CVE-2017-8565)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8573)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics Component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8577)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8578)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics Component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8580)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of objects in memory. A     local attacker can exploit this, via a specially crafted     application, to run arbitrary code in kernel mode.
    (CVE-2017-8581)

  - An information disclosure vulnerability exists in the     HTTP.sys server application component due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to disclose sensitive information.
    (CVE-2017-8582)

  - A denial of service vulnerability exists in Windows     Explorer that is triggered when Explorer attempts to     open a non-existent file. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a specially crafted website, to cause a user's system to     stop responding. (CVE-2017-8587)

  - A remote code execution vulnerability exists in WordPad     due to improper parsing of specially crafted files. An     unauthenticated, remote attacker can exploit this, by     convincing a user to open a specially crafted file, to     execute arbitrary code in the context of the current     user. (CVE-2017-8588)

  - A remote code execution vulnerability exists in the     Windows Search component due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by sending specially crafted messages     to the Windows Search service, to elevate privileges and     execute arbitrary code. (CVE-2017-8589)

  - An elevation of privilege vulnerability exists in the     Windows Common Log File System (CLFS) driver due to     improper handling of objects in memory. A local attacker     can exploit this, via a specially crafted application,     to run processes in an elevated context. (CVE-2017-8590)

  - A security bypass vulnerability exists in Microsoft     browsers due to improper handling of redirect requests.
    An unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to bypass CORS redirect restrictions. (CVE-2017-8592)

  - A remote code execution vulnerability exists in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8606)

  - A remote code execution vulnerability exists in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8607)

  - A remote code execution vulnerability exists in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8608)

  - A remote code execution vulnerability exists in     Microsoft Edge in the scripting engine due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a specially crafted website, to execute     arbitrary code in the context of the current user.
    (CVE-2017-8610)

The remote Windows 10 version 1511 host is missing security update KB4025344. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     Windows Performance Monitor Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to create a     Data Collector Set and import a specially crafted XML     file, to disclose arbitrary files via an XML external     entity (XXE) declaration. (CVE-2017-0170)

  - A remote code execution vulnerability exists in Windows     Explorer due to improper handling of executable files     and shares during rename operations. An unauthenticated,     remote attacker can exploit this, by convincing a user     to open a specially crafted file, to execute arbitrary     code in the context of the current user. (CVE-2017-8463)

  - Multiple elevation of privilege vulnerabilities exist in     the Microsoft Graphics component due to improper     handling of objects in memory. A local attacker can     exploit these, via a specially crafted application, to     run arbitrary code in kernel mode. (CVE-2017-8467,     CVE-2017-8556, CVE-2017-8573, CVE-2017-8577,     CVE-2017-8578, CVE-2017-8580)

  - An information disclosure vulnerability exists in Win32k     due to improper handling of objects in memory. A local     attacker can exploit this, via a specially crafted     application, to disclose sensitive information.
    (CVE-2017-8486)

  - A security bypass vulnerability exists in Microsoft     Windows when handling Kerberos ticket exchanges due to a     failure to prevent tampering with the SNAME field. A     man-in-the-middle attacker can exploit this to bypass     the Extended Protection for Authentication security     feature. (CVE-2017-8495)

  - An information disclosure vulnerability exists in the     Windows System Information Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to open a     specially crafted file, to disclose arbitrary files via     an XML external entity (XXE) declaration.
    (CVE-2017-8557)

  - An elevation of privilege vulnerability exists in the     Windows kernel due to improper handling of objects in     memory. A local attacker can exploit this, via a     specially crafted application, to execute arbitrary code     with elevated permissions. (CVE-2017-8561)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of calls to Advanced     Local Procedure Call (ALPC). An authenticated, remote     attacker can exploit this via a specially crafted     application, to run processes in an elevated context.
    (CVE-2017-8562)

  - An elevation of privilege vulnerability exists in     Windows due to Kerberos falling back to NT LAN Manager     (NTLM) Authentication Protocol as the default     authentication protocol. An authenticated, remote     attacker can exploit this, via an application that     sends specially crafted traffic to a domain controller,     to run processes in an elevated context. (CVE-2017-8563)

  - An information disclosure vulnerability exists in the     Windows kernel due to improper initialization of objects     in memory. An authenticated, remote attacker can exploit     this, via a specially crafted application, to bypass     Kernel Address Space Layout Randomization (KASLR) and     disclose the base address of the kernel driver.
    (CVE-2017-8564)

  - A remote code execution vulnerability exists in     PowerShell when handling a PSObject that wraps a CIM     instance. An authenticated, remote attacker can exploit     this, via a specially crafted script, to execute     arbitrary code in a PowerShell remote session.
    (CVE-2017-8565)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of objects in memory. A     local attacker can exploit this, via a specially crafted     application, to run arbitrary code in kernel mode.
    (CVE-2017-8581)

  - An information disclosure vulnerability exists in the     HTTP.sys server application component due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to disclose sensitive information.
    (CVE-2017-8582)

  - A denial of service vulnerability exists in the     Microsoft Common Runtime Library component due to     improper handling of web requests. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to cause a denial of service condition     in a .NET application. (CVE-2017-8585)

  - A denial of service vulnerability exists in Windows     Explorer that is triggered when Explorer attempts to     open a non-existent file. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a specially crafted website, to cause a user's system to     stop responding. (CVE-2017-8587)

  - A remote code execution vulnerability exists in WordPad     due to improper parsing of specially crafted files. An     unauthenticated, remote attacker can exploit this, by     convincing a user to open a specially crafted file, to     execute arbitrary code in the context of the current     user. (CVE-2017-8588)

  - A remote code execution vulnerability exists in the     Windows Search component due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by sending specially crafted messages     to the Windows Search service, to elevate privileges and     execute arbitrary code. (CVE-2017-8589)

  - An elevation of privilege vulnerability exists in the     Windows Common Log File System (CLFS) driver due to     improper handling of objects in memory. A local attacker     can exploit this, via a specially crafted application,     to run processes in an elevated context. (CVE-2017-8590)

  - A security bypass vulnerability exists in Microsoft     browsers due to improper handling of redirect requests.
    An unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to bypass CORS redirect restrictions. (CVE-2017-8592)

  - Multiple remote code execution vulnerability exist in     Microsoft Edge in the scripting engine due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit these, by convincing a user     to visit a specially crafted website, to execute     arbitrary code in the context of the current user.
    (CVE-2017-8595, CVE-2017-8598, CVE-2017-8603,     CVE-2017-8604, CVE-2017-8605, CVE-2017-8619)

  - A security bypass vulnerability exists in Microsoft Edge     due to a failure to correctly apply the same-origin     policy for HTML elements present in other browser     windows. An unauthenticated, remote attacker can exploit     this, by convincing a user to follow a link, to cause     the user to load a malicious website. (CVE-2017-8599)

  - A remote code execution vulnerability exists in     Microsoft Edge in the Chakra JavaScript engine due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8601)

  - A spoofing vulnerability exists in Microsoft browsers     due to improper parsing of HTTP content. An     unauthenticated, remote attacker can exploit this, by     convincing a user to click a specially crafted URL, to     redirect the user to a malicious website.
    (CVE-2017-8602)

  - Multiple remote code execution vulnerabilities exist in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8606, CVE-2017-8607, CVE-2017-8608)

  - A remote code execution vulnerability exists in     Microsoft browsers in the scripting engine due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8609)

  - A spoofing vulnerability exists in Microsoft Edge due to     improper parsing of HTTP content. An unauthenticated,     remote attacker can exploit this, by convincing a user     to click a specially crafted URL, to redirect the user     to a malicious website. (CVE-2017-8611)

  - A remote code execution vulnerability exists in Internet     Explorer in the VBScript engine due to improper handling     of objects in memory. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a specially crafted website, to execute arbitrary code     in the context of the current user. (CVE-2017-8618)

The remote Windows 10 version 1703 host is missing security update KB4025342. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     Windows Performance Monitor Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to create a     Data Collector Set and import a specially crafted XML     file, to disclose arbitrary files via an XML external     entity (XXE) declaration. (CVE-2017-0170)

  - A remote code execution vulnerability exists in Windows     Explorer due to improper handling of executable files     and shares during rename operations. An unauthenticated,     remote attacker can exploit this, by convincing a user     to open a specially crafted file, to execute arbitrary     code in the context of the current user. (CVE-2017-8463)

  - Multiple elevation of privilege vulnerabilities exist in     the Microsoft Graphics component due to improper     handling of objects in memory. A local attacker can     exploit these, via a specially crafted application, to     run arbitrary code in kernel mode. (CVE-2017-8467,     CVE-2017-8556, CVE-2017-8573, CVE-2017-8574,     CVE-2017-8577, CVE-2017-8578, CVE-2017-8580)

  - An information disclosure vulnerability exists in Win32k     due to improper handling of objects in memory. A local     attacker can exploit this, via a specially crafted     application, to disclose sensitive information.
    (CVE-2017-8486)

  - A security bypass vulnerability exists in Microsoft     Windows when handling Kerberos ticket exchanges due to a     failure to prevent tampering with the SNAME field. A     man-in-the-middle attacker can exploit this to bypass     the Extended Protection for Authentication security     feature. (CVE-2017-8495)

  - An information disclosure vulnerability exists in the     Windows System Information Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to open a     specially crafted file, to disclose arbitrary files via     an XML external entity (XXE) declaration.
    (CVE-2017-8557)

  - An elevation of privilege vulnerability exists in the     Windows kernel due to improper handling of objects in     memory. A local attacker can exploit this, via a     specially crafted application, to execute arbitrary code     with elevated permissions. (CVE-2017-8561)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of calls to Advanced     Local Procedure Call (ALPC). An authenticated, remote     attacker can exploit this via a specially crafted     application, to run processes in an elevated context.
    (CVE-2017-8562)

  - An elevation of privilege vulnerability exists in     Windows due to Kerberos falling back to NT LAN Manager     (NTLM) Authentication Protocol as the default     authentication protocol. An authenticated, remote     attacker can exploit this, via an application that     sends specially crafted traffic to a domain controller,     to run processes in an elevated context. (CVE-2017-8563)

  - An information disclosure vulnerability exists in the     Windows kernel due to improper initialization of objects     in memory. An authenticated, remote attacker can exploit     this, via a specially crafted application, to bypass     Kernel Address Space Layout Randomization (KASLR) and     disclose the base address of the kernel driver.
    (CVE-2017-8564)

  - A remote code execution vulnerability exists in     PowerShell when handling a PSObject that wraps a CIM     instance. An authenticated, remote attacker can exploit     this, via a specially crafted script, to execute     arbitrary code in a PowerShell remote session.
    (CVE-2017-8565)

  - An elevation of privilege vulnerability exists in     Windows Input Method Editor (IME) due to improper     handling of parameters in a method of a DCOM class. A     local attacker can exploit this, via a specially crafted     application, to run processes in an elevated context.
    (CVE-2017-8566)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of objects in memory. A     local attacker can exploit this, via a specially crafted     application, to run arbitrary code in kernel mode.
    (CVE-2017-8581)

  - An information disclosure vulnerability exists in the     HTTP.sys server application component due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to disclose sensitive information.
    (CVE-2017-8582)

  - A denial of service vulnerability exists in the     Microsoft Common Runtime Library component due to     improper handling of web requests. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to cause a denial of service condition     in a .NET application. (CVE-2017-8585)

  - A remote code execution vulnerability exists in WordPad     due to improper parsing of specially crafted files. An     unauthenticated, remote attacker can exploit this, by     convincing a user to open a specially crafted file, to     execute arbitrary code in the context of the current     user. (CVE-2017-8588)

  - A remote code execution vulnerability exists in the     Windows Search component due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by sending specially crafted messages     to the Windows Search service, to elevate privileges and     execute arbitrary code. (CVE-2017-8589)

  - An elevation of privilege vulnerability exists in the     Windows Common Log File System (CLFS) driver due to     improper handling of objects in memory. A local attacker     can exploit this, via a specially crafted application,     to run processes in an elevated context. (CVE-2017-8590)

  - A security bypass vulnerability exists in Microsoft     browsers due to improper handling of redirect requests.
    An unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to bypass CORS redirect restrictions. (CVE-2017-8592)

  - A remote code execution vulnerability exists in     Microsoft Edge due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     website, to execute arbitrary code in the context of the     current user. (CVE-2017-8596)

  - Multiple remote code execution vulnerability exist in     Microsoft Edge in the scripting engine due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit these, by convincing a user     to visit a specially crafted website, to execute     arbitrary code in the context of the current user.
    (CVE-2017-8598, CVE-2017-8603, CVE-2017-8604,     CVE-2017-8605, CVE-2017-8610, CVE-2017-8619)

  - A security bypass vulnerability exists in Microsoft Edge     due to a failure to correctly apply the same-origin     policy for HTML elements present in other browser     windows. An unauthenticated, remote attacker can exploit     this, by convincing a user to follow a link, to cause     the user to load a malicious website. (CVE-2017-8599)

  - A remote code execution vulnerability exists in     Microsoft Edge in the Chakra JavaScript engine due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8601)

  - A spoofing vulnerability exists in Microsoft browsers     due to improper parsing of HTTP content. An     unauthenticated, remote attacker can exploit this, by     convincing a user to click a specially crafted URL, to     redirect the user to a malicious website.
    (CVE-2017-8602)

  - Multiple remote code execution vulnerabilities exist in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8606, CVE-2017-8607, CVE-2017-8608)

  - A remote code execution vulnerability exists in     Microsoft browsers in the scripting engine due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8609)

  - A spoofing vulnerability exists in Microsoft Edge due to     improper parsing of HTTP content. An unauthenticated,     remote attacker can exploit this, by convincing a user     to click a specially crafted URL, to redirect the user     to a malicious website. (CVE-2017-8611)

  - A remote code execution vulnerability exists in     Microsoft Edge due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     website, to execute arbitrary code in the context of the     current user. (CVE-2017-8617)

  - A remote code execution vulnerability exists in Internet     Explorer in the VBScript engine due to improper handling     of objects in memory. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a specially crafted website, to execute arbitrary code     in the context of the current user. (CVE-2017-8618)

The remote Windows host is missing security update KB4025339. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     Windows Performance Monitor Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to create a     Data Collector Set and import a specially crafted XML     file, to disclose arbitrary files via an XML external     entity (XXE) declaration. (CVE-2017-0170)

  - A remote code execution vulnerability exists in Windows     Explorer due to improper handling of executable files     and shares during rename operations. An unauthenticated,     remote attacker can exploit this, by convincing a user     to open a specially crafted file, to execute arbitrary     code in the context of the current user. (CVE-2017-8463)

  - Multiple elevation of privilege vulnerabilities exist in     the Microsoft Graphics component due to improper     handling of objects in memory. A local attacker can     exploit these, via a specially crafted application, to     run arbitrary code in kernel mode. (CVE-2017-8467,     CVE-2017-8556, CVE-2017-8573, CVE-2017-8574,     CVE-2017-8577, CVE-2017-8578, CVE-2017-8580)

  - An information disclosure vulnerability exists in Win32k     due to improper handling of objects in memory. A local     attacker can exploit this, via a specially crafted     application, to disclose sensitive information.
    (CVE-2017-8486)

  - A security bypass vulnerability exists in Microsoft     Windows when handling Kerberos ticket exchanges due to a     failure to prevent tampering with the SNAME field. A     man-in-the-middle attacker can exploit this to bypass     the Extended Protection for Authentication security     feature. (CVE-2017-8495)

  - An information disclosure vulnerability exists in the     Windows System Information Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to open a     specially crafted file, to disclose arbitrary files via     an XML external entity (XXE) declaration.
    (CVE-2017-8557)

  - An elevation of privilege vulnerability exists in the     Windows kernel due to improper handling of objects in     memory. A local attacker can exploit this, via a     specially crafted application, to execute arbitrary code     with elevated permissions. (CVE-2017-8561)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of calls to Advanced     Local Procedure Call (ALPC). An authenticated, remote     attacker can exploit this via a specially crafted     application, to run processes in an elevated context.
    (CVE-2017-8562)

  - An elevation of privilege vulnerability exists in     Windows due to Kerberos falling back to NT LAN Manager     (NTLM) Authentication Protocol as the default     authentication protocol. An authenticated, remote     attacker can exploit this, via an application that     sends specially crafted traffic to a domain controller,     to run processes in an elevated context.
    (CVE-2017-8563)*

  - An information disclosure vulnerability exists in the     Windows kernel due to improper initialization of objects     in memory. An authenticated, remote attacker can exploit     this, via a specially crafted application, to bypass     Kernel Address Space Layout Randomization (KASLR) and     disclose the base address of the kernel driver.
    (CVE-2017-8564)

  - A remote code execution vulnerability exists in     PowerShell when handling a PSObject that wraps a CIM     instance. An authenticated, remote attacker can exploit     this, via a specially crafted script, to execute     arbitrary code in a PowerShell remote session.
    (CVE-2017-8565)

  - An elevation of privilege vulnerability exists in     Windows Input Method Editor (IME) due to improper     handling of parameters in a method of a DCOM class. A     local attacker can exploit this, via a specially crafted     application, to run processes in an elevated context.
    (CVE-2017-8566)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of objects in memory. A     local attacker can exploit this, via a specially crafted     application, to run arbitrary code in kernel mode.
    (CVE-2017-8581)

  - An information disclosure vulnerability exists in the     HTTP.sys server application component due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to disclose sensitive information.
    (CVE-2017-8582)

  - A remote code execution vulnerability exists in     Microsoft HoloLens due to improper handling of objects     in memory. An unauthenticated, remote attacker can     exploit this, via a specially crafted packet, to execute     arbitrary code. (CVE-2017-8584)

  - A denial of service vulnerability exists in the     Microsoft Common Runtime Library component due to     improper handling of web requests. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to cause a denial of service condition     in a .NET application. (CVE-2017-8585)

  - A remote code execution vulnerability exists in WordPad     due to improper parsing of specially crafted files. An     unauthenticated, remote attacker can exploit this, by     convincing a user to open a specially crafted file, to     execute arbitrary code in the context of the current     user. (CVE-2017-8588)

  - A remote code execution vulnerability exists in the     Windows Search component due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by sending specially crafted messages     to the Windows Search service, to elevate privileges and     execute arbitrary code. (CVE-2017-8589)

  - An elevation of privilege vulnerability exists in the     Windows Common Log File System (CLFS) driver due to     improper handling of objects in memory. A local attacker     can exploit this, via a specially crafted application,     to run processes in an elevated context. (CVE-2017-8590)

  - A security bypass vulnerability exists in Microsoft     browsers due to improper handling of redirect requests.
    An unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to bypass CORS redirect restrictions. (CVE-2017-8592)

  - Multiple remote code execution vulnerability exist in     Microsoft Edge in the scripting engine due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit these, by convincing a user     to visit a specially crafted website, to execute     arbitrary code in the context of the current user.
    (CVE-2017-8595, CVE-2017-8598, CVE-2017-8603,     CVE-2017-8604, CVE-2017-8605, CVE-2017-8619)

  - A remote code execution vulnerability exists in     Microsoft Edge due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     website, to execute arbitrary code in the context of the     current user. (CVE-2017-8596)

  - A security bypass vulnerability exists in Microsoft Edge     due to a failure to correctly apply the same-origin     policy for HTML elements present in other browser     windows. An unauthenticated, remote attacker can exploit     this, by convincing a user to follow a link, to cause     the user to load a malicious website. (CVE-2017-8599)

  - A remote code execution vulnerability exists in     Microsoft Edge in the Chakra JavaScript engine due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8601)

  - A spoofing vulnerability exists in Microsoft browsers     due to improper parsing of HTTP content. An     unauthenticated, remote attacker can exploit this, by     convincing a user to click a specially crafted URL, to     redirect the user to a malicious website.
    (CVE-2017-8602)

  - Multiple remote code execution vulnerabilities exist in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8606, CVE-2017-8607, CVE-2017-8608)

  - A remote code execution vulnerability exists in     Microsoft browsers in the scripting engine due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8609)

  - A spoofing vulnerability exists in Microsoft Edge due to     improper parsing of HTTP content. An unauthenticated,     remote attacker can exploit this, by convincing a user     to click a specially crafted URL, to redirect the user     to a malicious website. (CVE-2017-8611)

  - A remote code execution vulnerability exists in Internet     Explorer in the VBScript engine due to improper handling     of objects in memory. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a specially crafted website, to execute arbitrary code     in the context of the current user. (CVE-2017-8618)

    * note CVE-2017-8563 introduces a registry setting that     administrators can use to help make LDAP authentication     over SSL/TLS more secure, administrators need to create     a LdapEnforceChannelBinding registry setting on machine     running AD DS or AD LDS.

The remote Windows host is missing security update 4025333 or cumulative update 4025336. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     Windows Performance Monitor Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to create a     Data Collector Set and import a specially crafted XML     file, to disclose arbitrary files via an XML external     entity (XXE) declaration. (CVE-2017-0170)

  - A remote code execution vulnerability exists in Windows     Explorer due to improper handling of executable files     and shares during rename operations. An unauthenticated,     remote attacker can exploit this, by convincing a user     to open a specially crafted file, to execute arbitrary     code in the context of the current user. (CVE-2017-8463)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8467)

  - An information disclosure vulnerability exists in Win32k     due to improper handling of objects in memory. A local     attacker can exploit this, via a specially crafted     application, to disclose sensitive information.
    (CVE-2017-8486)

  - A security bypass vulnerability exists in Microsoft     Windows when handling Kerberos ticket exchanges due to a     failure to prevent tampering with the SNAME field. A     man-in-the-middle attacker can exploit this to bypass     the Extended Protection for Authentication security     feature. (CVE-2017-8495)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8556)

  - An information disclosure vulnerability exists in the     Windows System Information Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to open a     specially crafted file, to disclose arbitrary files via     an XML external entity (XXE) declaration.
    (CVE-2017-8557)

  - An elevation of privilege vulnerability exists in the     Windows kernel due to improper handling of objects in     memory. A local attacker can exploit this, via a     specially crafted application, to execute arbitrary code     with elevated permissions. (CVE-2017-8561)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of calls to Advanced     Local Procedure Call (ALPC). An authenticated, remote     attacker can exploit this via a specially crafted     application, to run processes in an elevated context.
    (CVE-2017-8562)

  - An elevation of privilege vulnerability exists in     Windows due to Kerberos falling back to NT LAN Manager     (NTLM) Authentication Protocol as the default     authentication protocol. An authenticated, remote     attacker can exploit this, via an application that     sends specially crafted traffic to a domain controller,     to run processes in an elevated context. (CVE-2017-8563)

  - An information disclosure vulnerability exists in the     Windows kernel due to improper initialization of objects     in memory. An authenticated, remote attacker can exploit     this, via a specially crafted application, to bypass     Kernel Address Space Layout Randomization (KASLR) and     disclose the base address of the kernel driver.
    (CVE-2017-8564)

  - A remote code execution vulnerability exists in     PowerShell when handling a PSObject that wraps a CIM     instance. An authenticated, remote attacker can exploit     this, via a specially crafted script, to execute     arbitrary code in a PowerShell remote session.
    (CVE-2017-8565)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8573)

  - Multiple elevation of privilege vulnerabilities exist in     the Microsoft Graphics Component due to improper     handling of objects in memory. A local attacker can     exploit these, via a specially crafted application, to     run arbitrary code in kernel mode. (CVE-2017-8577,     CVE-2017-8578, CVE-2017-8580)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of objects in memory. A     local attacker can exploit this, via a specially crafted     application, to run arbitrary code in kernel mode.
    (CVE-2017-8581)

  - An information disclosure vulnerability exists in the     HTTP.sys server application component due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to disclose sensitive information.
    (CVE-2017-8582)

  - A denial of service vulnerability exists in Windows     Explorer that is triggered when Explorer attempts to     open a non-existent file. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a specially crafted website, to cause a user's system to     stop responding. (CVE-2017-8587)

  - A remote code execution vulnerability exists in WordPad     due to improper parsing of specially crafted files. An     unauthenticated, remote attacker can exploit this, by     convincing a user to open a specially crafted file, to     execute arbitrary code in the context of the current     user. (CVE-2017-8588)

  - A remote code execution vulnerability exists in the     Windows Search component due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by sending specially crafted messages     to the Windows Search service, to elevate privileges and     execute arbitrary code. (CVE-2017-8589)

  - An elevation of privilege vulnerability exists in the     Windows Common Log File System (CLFS) driver due to     improper handling of objects in memory. A local attacker     can exploit this, via a specially crafted application,     to run processes in an elevated context. (CVE-2017-8590)

  - A security bypass vulnerability exists in Microsoft     browsers due to improper handling of redirect requests.
    An unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to bypass CORS redirect restrictions. (CVE-2017-8592)

  - A remote code execution vulnerability exists in Internet     Explorer due to improper handling of objects in memory.
    An unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8594)

  - A spoofing vulnerability exists in Microsoft browsers     due to improper parsing of HTTP content. An     unauthenticated, remote attacker can exploit this, by     convincing a user to click a specially crafted URL, to     redirect the user to a malicious website.
    (CVE-2017-8602)

  - A remote code execution vulnerability exists in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8606)

  - A remote code execution vulnerability exists in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8607)

  - A remote code execution vulnerability exists in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8608)

  - A remote code execution vulnerability exists in Internet     Explorer in the VBScript engine due to improper handling     of objects in memory. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a specially crafted website, to execute arbitrary code     in the context of the current user. (CVE-2017-8618)

ID	Name	Product	Family	Severity
104383	KB4025338: Windows 10 July 2017 Cumulative Update	Nessus	Windows : Microsoft Bulletins	critical
101375	Windows Server 2012 July 2017 Security Updates	Nessus	Windows : Microsoft Bulletins	critical
101369	KB4025344: Windows 10 Version 1511 July 2017 Cumulative Update	Nessus	Windows : Microsoft Bulletins	critical
101368	KB4025342: Windows 10 Version 1703 July 2017 Cumulative Update	Nessus	Windows : Microsoft Bulletins	critical
101366	KB4025339: Windows 10 Version 1607 and Windows Server 2016 July 2017 Cumulative Update	Nessus	Windows : Microsoft Bulletins	critical
101365	Windows 8.1 and Windows Server 2012 R2 July 2017 Security Updates	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2017-8562

high

Tenable Plugins

critical

critical

critical

critical

critical

critical