Detections
Analytics

Windows 8.1 and Windows Server 2012 R2 June 2017 Security Updates

critical Nessus Plugin ID 100764

Language:

Synopsis

The remote Windows host is affected by multiple vulnerabilities.

Description

The remote Windows host is missing security update 4022717 or cumulative update 4022726. It is, therefore, affected by multiple vulnerabilities :

 - An elevation of privilege vulnerability exists in Windows Hyper-V instruction emulation due to a failure to properly enforce privilege levels. An attacker on a guest operating system can exploit this to gain elevated privileges on the guest. Note that the host operating system is not vulnerable. (CVE-2017-0193)

 - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0284, CVE-2017-0285)

 - Multiple remote code execution vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to execute arbitrary code in the context of the current user.
 (CVE-2017-0283, CVE-2017-8528)

 - Multiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to disclose the contents of memory.
 (CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533)

 - Multiple remote code execution vulnerabilities exist in Microsoft Windows due to improper parsing of PDF files.
 An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted PDF file, to execute arbitrary code in the context of the current user. (CVE-2017-0291, CVE-2017-0292)

 - A remote code execution vulnerability exists in Microsoft Windows due to improper handling of cabinet files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted cabinet file, to execute arbitrary code in the context of the current user. (CVE-2017-0294)

 - An elevation of privilege vulnerability exists in tdx.sys due to a failure to check the length of a buffer prior to copying memory to it. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code in an elevated context.
 (CVE-2017-0296)

 - An elevation of privilege vulnerability exists in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code with elevated permissions. (CVE-2017-0297)

 - An elevation of privilege vulnerability exists in the DCOM object in Helppane.exe, when configured to run as the interactive user, due to a failure to properly authenticate the client. An authenticated, remote attacker can exploit this, via a specially crafted application, to run arbitrary code in another user's session after that user has logged on to the same system using Terminal Services or Fast User Switching.
 (CVE-2017-0298)

 - Multiple information disclosure vulnerabilities exist in the Windows kernel due to improper initialization of objects in memory. An authenticated, remote attacker can exploit these, via a specially crafted application, to disclose the base address of the kernel driver.
 (CVE-2017-0299, CVE-2017-0300, CVE-2017-8462, CVE-2017-8485)

 - An information disclosure vulnerability exists in Microsoft Windows due to improper parsing of PDF files.
 An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted PDF file, to disclose the contents of memory. (CVE-2017-8460)

 - A remote code execution vulnerability exists in Windows due to improper handling of shortcuts. An unauthenticated, remote attacker can exploit this, by convincing a user to insert a removable drive containing a malicious shortcut and binary, to automatically execute arbitrary code in the context of the current user. (CVE-2017-8464)

 - Multiple elevation of privilege vulnerabilities exist in the Windows kernel-mode driver due to improper handling of objects in memory. A local attacker can exploit these, via a specially crafted application, to run processes in an elevated context. (CVE-2017-8465, CVE-2017-8466, CVE-2017-8468)

 - Multiple information disclosure vulnerabilities exist in the Windows kernel due to improper initialization of objects in memory. An authenticated, remote attacker can exploit these, via a specially crafted application, to disclose sensitive information. (CVE-2017-8469, CVE-2017-8470, CVE-2017-8471, CVE-2017-8473, CVE-2017-8474, CVE-2017-8475, CVE-2017-8476, CVE-2017-8477, CVE-2017-8478, CVE-2017-8479, CVE-2017-8480, CVE-2017-8481, CVE-2017-8482, CVE-2017-8483, CVE-2017-8484, CVE-2017-8488, CVE-2017-8489, CVE-2017-8490, CVE-2017-8491, CVE-2017-8492)

 - A security bypass vulnerability exists due to a failure to enforce case sensitivity for certain variable checks.
 A local attacker can exploit this, via a specially crafted application, to bypass Unified Extensible Firmware Interface (UEFI) variable security.
 (CVE-2017-8493)

 - A remote code execution vulnerability exists in the Windows font library due to improper handling of embedded fonts. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website or open a specially crafted Microsoft document, to execute arbitrary code in the context of the current user. (CVE-2017-8527)

 - A remote code execution vulnerability exists in the Windows Search functionality due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, via a specially crafted SMB message, to execute arbitrary code. (CVE-2017-8543)

 - An information disclosure vulnerability exists in the Windows Search functionality due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, via a specially crafted SMB message, to disclose sensitive information. (CVE-2017-8544)

 - Multiple information disclosure vulnerabilities exist in the Windows kernel due to improper handling of objects in memory. An authenticated, remote attacker can exploit these, via a specially crafted application, to disclose the contents of memory. (CVE-2017-8553, CVE-2017-8554)

Solution

Apply Security Only update KB4022717 or Cumulative update KB4022726.

See Also

http://www.nessus.org/u?5f83ad76

Plugin Details

Severity: Critical

ID: 100764

File Name: smb_nt_ms17_jun_4022726.nasl

Version: 1.18

Type: local

Agent: windows

Published: 6/13/2017

Updated: 6/17/2024

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2017-8543

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows_8, cpe:/o:microsoft:windows_server_2012:r2

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/13/2017

Vulnerability Publication Date: 6/13/2017

CISA Known Exploited Vulnerability Due Dates: 6/14/2022, 8/10/2022

Exploitable With

CANVAS (CANVAS)

Metasploit (LNK Code Execution Vulnerability)

Reference Information

CVE: CVE-2017-0193, CVE-2017-0282, CVE-2017-0283, CVE-2017-0284, CVE-2017-0285, CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-0291, CVE-2017-0292, CVE-2017-0294, CVE-2017-0296, CVE-2017-0297, CVE-2017-0298, CVE-2017-0299, CVE-2017-0300, CVE-2017-8460, CVE-2017-8462, CVE-2017-8464, CVE-2017-8465, CVE-2017-8466, CVE-2017-8468, CVE-2017-8469, CVE-2017-8470, CVE-2017-8471, CVE-2017-8473, CVE-2017-8474, CVE-2017-8475, CVE-2017-8476, CVE-2017-8477, CVE-2017-8478, CVE-2017-8479, CVE-2017-8480, CVE-2017-8481, CVE-2017-8482, CVE-2017-8483, CVE-2017-8484, CVE-2017-8485, CVE-2017-8488, CVE-2017-8489, CVE-2017-8490, CVE-2017-8491, CVE-2017-8492, CVE-2017-8493, CVE-2017-8527, CVE-2017-8528, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533, CVE-2017-8543, CVE-2017-8544, CVE-2017-8553, CVE-2017-8554

BID: 98818, 98819, 98820, 98821, 98824, 98826, 98835, 98836, 98837, 98839, 98840, 98842, 98843, 98844, 98845, 98846, 98847, 98848, 98849, 98850, 98852, 98853, 98854, 98856, 98857, 98858, 98859, 98860, 98862, 98864, 98865, 98867, 98869, 98870, 98878, 98884, 98885, 98887, 98900, 98901, 98902, 98903, 98914, 98918, 98920, 98922, 98923, 98929, 98933, 98940, 98942, 98949

MSFT: MS17-4022717, MS17-4022726

MSKB: 4022717, 4022726