The remote Windows host is missing security update 4038782.
It is, therefore, affected by multiple vulnerabilities :

  - A race condition that could lead to a remote code     execution vulnerability exists in NetBT Session Services     when NetBT fails to maintain certain sequencing     requirements. (CVE-2017-0161)

  - A vulnerability exists when Microsoft Edge improperly     accesses objects in memory. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. (CVE-2017-11766)

  - A spoofing vulnerability exists in Microsoft's     implementation of the Bluetooth stack. An attacker who     successfully exploited this vulnerability could perform     a man-in-the-middle attack and force a user's computer     to unknowingly route traffic through the attacker's     computer. The attacker can then monitor and read the     traffic before sending it on to the intended recipient.
    (CVE-2017-8628)

  - An information disclosure vulnerability exists when     Microsoft Edge improperly handles clipboard events. For     an attack to be successful, an attacker must persuade a     user to visit a malicious website and leave it open     during clipboard activities. The update addresses the     vulnerability by changing how Microsoft Edge handles     clipboard events in the browser. (CVE-2017-8643)

  - An elevation of privilege vulnerability exists in     Windows when the Windows kernel-mode driver fails to     properly handle objects in memory. An attacker who     successfully exploited this vulnerability could run     arbitrary code in kernel mode. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. To exploit     this vulnerability, an attacker would first have to log     on to the system. An attacker could then run a specially     crafted application that could exploit the vulnerability     and take control of an affected system. The update     addresses this vulnerability by correcting how the     Windows kernel-mode driver handles objects in memory.
    (CVE-2017-8675)

  - An information disclosure vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory, allowing an attacker to     retrieve information from a targeted system. By itself,     the information disclosure does not allow arbitrary code     execution; however, it could allow arbitrary code to be     run if the attacker uses it in combination with another     vulnerability. (CVE-2017-8676)

  - A information disclosure vulnerability exists when the     Windows GDI+ component improperly discloses kernel     memory addresses. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system.
    (CVE-2017-8677, CVE-2017-8681)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.(CVE-2017-8682)

  - An information disclosure vulnerability exists when the     Microsoft Windows Graphics Component improperly handles     objects in memory. An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.(CVE-2017-8683)

  - A memory corruption vulnerability exists in the Windows     Server DHCP service when an attacker sends specially     crafted packets to a DHCP failover server. An attacker     who successfully exploited the vulnerability could     either run arbitrary code on the DHCP failover server or     cause the DHCP service to become nonresponsive.
    (CVE-2017-8686)

  - An Information disclosure vulnerability exists in     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (KASLR) bypass. An attacker who     successfully exploited this vulnerability could retrieve     the memory address of a kernel object.(CVE-2017-8687)

  - An information disclosure vulnerability exists in the     way that the Windows Graphics Device Interface+ (GDI+)     handles objects in memory, allowing an attacker to     retrieve information from a targeted system. By itself,     the information disclosure does not allow arbitrary code     execution; however, it could allow arbitrary code to be     run if the attacker uses it in combination with another     vulnerability.(CVE-2017-8688)

  - A remote code execution vulnerability exists due to the     way Windows Uniscribe handles objects in memory. An     attacker who successfully exploited this vulnerability     could take control of the affected system. An attacker     could then install programs; view, change, or delete     data; or create new accounts with full user rights.
    (CVE-2017-8692)

  - An information disclosure vulnerability exists when     Windows Uniscribe improperly discloses the contents of     its memory. An attacker who successfully exploited the     vulnerability could obtain information to further     compromise the users system.
    (CVE-2017-8695)

  - A remote code execution vulnerability exists when     Windows Shell does not properly validate file copy     destinations. An attacker who successfully exploited the     vulnerability could run arbitrary code in the context of     the current user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system.
    (CVE-2017-8699)

  - An elevation of privilege vulnerability exists in     Windows Error Reporting (WER) when WER handles and     executes files. The vulnerability could allow elevation     of privilege if an attacker can successfully exploit it.
    An attacker who successfully exploited the vulnerability     could gain greater access to sensitive information and     system functionality.
    (CVE-2017-8702)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Virtual PCI on a host server fails to properly     validate input from a privileged user on a guest     operating system.
    input. (CVE-2017-8704)

  - An information disclosure vulnerability exists when the     Windows kernel fails to properly initialize a memory     address, allowing an attacker to retrieve information     that could lead to a Kernel Address Space Layout     Randomization (KASLR) bypass. An attacker who     successfully exploited this vulnerability could retrieve     the base address of the kernel driver from a compromised     process. (CVE-2017-8708)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.
    (CVE-2017-8706, CVE-2017-8707, CVE-2017-8711,     CVE-2017-8712, CVE-2017-8713)

  - A remote code execution vulnerability exists in the VM     Host Agent Service of Remote Desktop Virtual Host role     when it fails to properly validate input from an     authenticated user on a guest operating system.
    (CVE-2017-8714)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system. (CVE-2017-8678, CVE-2017-8679, CVE-2017-8709,     CVE-2017-8719)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.(CVE-2017-8720)

  - A spoofing vulnerability exists when Internet Explorer     improperly handles specific HTML content. An attacker     who successfully exploited this vulnerability could     trick a user into believing that the user was visiting a     legitimate website.
    (CVE-2017-8733)

  - A remote code execution vulnerability exists when     Microsoft Edge improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that enables an attacker to execute arbitrary code in     the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.
    (CVE-2017-8731, CVE-2017-8734)

  - A spoofing vulnerability exists when Microsoft Edge does     not properly parse HTTP content. An attacker who     successfully exploited this vulnerability could trick a     user by redirecting the user to a specially crafted     website. The specially crafted website could either     spoof content or serve as a pivot to chain an attack     with other vulnerabilities in web services.
    (CVE-2017-8735)

  - An information disclosure vulnerability exists in     Microsoft browsers due to improper parent domain     verification in certain functionality. An attacker who     successfully exploited the vulnerability could obtain     specific information that is used in the parent domain.
    (CVE-2017-8736)

  - A remote code execution vulnerability exists when     Microsoft Windows PDF Library improperly handles objects     in memory. The vulnerability could corrupt memory in a     way that enables an attacker to execute arbitrary code     in the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.
    (CVE-2017-8728, CVE-2017-8737)

  - A security feature bypass vulnerability exists in Device     Guard that could allow an attacker to inject malicious     code into a Windows PowerShell session.(CVE-2017-8746)

  - A remote code execution vulnerability exists in the way     that Microsoft browser JavaScript engines render content     when handling objects in memory. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. (CVE-2017-8649, CVE-2017-8660, CVE-2017-8741,     CVE-2017-8748)

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that an attacker could execute arbitrary code in the     context of the current user. (CVE-2017-8747,     CVE-2017-8749)

  - A remote code execution vulnerability exists when     Microsoft browsers improperly access objects in memory.
    The vulnerability could corrupt memory in such a way     that an attacker could execute arbitrary code in the     context of the current user.(CVE-2017-8750)

  - A security feature bypass exists in Microsoft Edge when     the Edge Content Security Policy (CSP) fails to properly     validate certain specially crafted documents. An     attacker who exploited the bypass could trick a user     into loading a page containing malicious content.
    (CVE-2017-8723, CVE-2017-8754)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Microsoft Edge. The vulnerability could corrupt memory     in such a way that an attacker could execute arbitrary     code in the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.
    (CVE-2017-11764, CVE-2017-8738, CVE-2017-8752,     CVE-2017-8753, CVE-2017-8755, CVE-2017-8756)

  - A remote code execution vulnerability exists in the way     Microsoft Edge handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user. (CVE-2017-8757)

  - A remote code execution vulnerability exists when     Microsoft .NET Framework processes untrusted input. An     attacker who successfully exploited this vulnerability     in software using the .NET framework could take control     of an affected system.
    (CVE-2017-8759)     
  - An information disclosure vulnerability exists in     Microsoft browsers in the scripting engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose files on a user's computer. (CVE-2017-8529)

Detections

Analytics

KB4038782: Windows 10 Version 1607 and Windows Server 2016 September 2017 Cumulative Update

critical Nessus Plugin ID 103128

Version 1.14

Version 1.13

Version 1.14 Jun 17, 2024, 3:35 PM Plugin metadata (add more granular CPEs to Windows OS plugins) Plugin Feed: 202406171535
Version 1.13 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311