The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709 Windows Server 2016 and Windows Server, version 1709 allows a remote code execution vulnerability due to how CredSSP validates request during the authentication process, aka "CredSSP Remote Code Execution Vulnerability".

The remote Windows host allows fallback to insecure versions of Credential Security Support Provider protocol (CredSSP). It is therefore, affected by a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could relay user credentials and use them to execute code on the target system. CredSSP is an authentication provider which processes authentication requests for other applications; any application which depends on CredSSP for authentication may be vulnerable to this type of attack. As an example of how an attacker would exploit this vulnerability against Remote Desktop Protocol, the attacker would need to run a specially crafted application and perform a man-in-the-middle attack against a Remote Desktop Protocol session. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting how Credential Security Support Provider protocol (CredSSP) validates requests during the authentication process. To be fully protected against this vulnerability users must enable Group Policy settings on their systems and update their Remote Desktop clients.
Affected systems include Windows version 1909 and prior.

This update for freerdp to version 2.0.0~rc4 fixes the following issues :

Security issues fixed :

  - CVE-2018-0886: Fix a remote code execution vulnerability     (CredSSP) (bsc#1085416, bsc#1087240, bsc#1104918)

  - CVE-2018-8789: Fix several denial of service     vulnerabilities in the in the NTLM Authentication module     (bsc#1117965)

  - CVE-2018-8785: Fix a potential remote code execution     vulnerability in the zgfx_decompress function     (bsc#1117967)

  - CVE-2018-8786: Fix a potential remote code execution     vulnerability in the update_read_bitmap_update function     (bsc#1117966)

  - CVE-2018-8787: Fix a potential remote code execution     vulnerability in the gdi_Bitmap_Decompress function     (bsc#1117964)

  - CVE-2018-8788: Fix a potential remote code execution     vulnerability in the nsc_rle_decode function     (bsc#1117963)

  - CVE-2018-8784: Fix a potential remote code execution     vulnerability in the zgfx_decompress_segment function     (bsc#1116708)

  - CVE-2018-1000852: Fixed a remote memory access in the     drdynvc_process_capability_request function     (bsc#1120507)

Other issues :

  - Upgraded to version 2.0.0-rc4 (FATE#326739)

  - Security and stability improvements, including     bsc#1103557 and bsc#1112028

  - gateway: multiple fixes and improvements

  - client/X11: support for rail (remote app) icons was     added

  - The licensing code was re-worked: Per-device licenses     are now saved on the client and used on re-connect:
    WARNING: this is a change in FreeRDP behavior regarding     licensing. If the old behavior is required, or no     licenses should be saved use the new command line option     +old-license (gh#/FreeRDP/FreeRDP#4979)

  - Improved order handling - only orders that were enable     during capability exchange are accepted. WARNING and     NOTE: some servers do improperly send orders that     weren't negotiated, for such cases the new command line     option /relax-order-checks was added to disable the     strict order checking. If connecting to xrdp the options     /relax-order-checks *and* +glyph-cache are required.
    (gh#/FreeRDP/FreeRDP#4926)

  - Fixed automount issues

  - Fixed several audio and microphone related issues

  - Fixed X11 Right-Ctrl ungrab feature

  - Fixed race condition in rdpsnd channel server.

  - Disabled SSE2 for ARM and powerpc

This update was imported from the SUSE:SLE-15:Update update project.

This update for freerdp to version 2.0.0~rc4 fixes the following issues :

Security issues fixed :

CVE-2018-0886: Fix a remote code execution vulnerability (CredSSP) (bsc#1085416, bsc#1087240, bsc#1104918)

CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication module (bsc#1117965)

CVE-2018-8785: Fix a potential remote code execution vulnerability in the zgfx_decompress function (bsc#1117967)

CVE-2018-8786: Fix a potential remote code execution vulnerability in the update_read_bitmap_update function (bsc#1117966)

CVE-2018-8787: Fix a potential remote code execution vulnerability in the gdi_Bitmap_Decompress function (bsc#1117964)

CVE-2018-8788: Fix a potential remote code execution vulnerability in the nsc_rle_decode function (bsc#1117963)

CVE-2018-8784: Fix a potential remote code execution vulnerability in the zgfx_decompress_segment function (bsc#1116708)

CVE-2018-1000852: Fixed a remote memory access in the drdynvc_process_capability_request function (bsc#1120507)

Other issues: Upgraded to version 2.0.0-rc4 (FATE#326739)

Security and stability improvements, including bsc#1103557 and bsc#1112028

gateway: multiple fixes and improvements

client/X11: support for rail (remote app) icons was added

The licensing code was re-worked: Per-device licenses are now saved on the client and used on re-connect: WARNING: this is a change in FreeRDP behavior regarding licensing. If the old behavior is required, or no licenses should be saved use the new command line option +old-license (gh#/FreeRDP/FreeRDP#4979)

Improved order handling - only orders that were enable during capability exchange are accepted. WARNING and NOTE: some servers do improperly send orders that weren't negotiated, for such cases the new command line option /relax-order-checks was added to disable the strict order checking. If connecting to xrdp the options /relax-order-checks

*and* +glyph-cache are required. (gh#/FreeRDP/FreeRDP#4926)

Fixed automount issues

Fixed several audio and microphone related issues

Fixed X11 Right-Ctrl ungrab feature

Fixed race condition in rdpsnd channel server.

Disabled SSE2 for ARM and powerpc

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for freerdp fixes the following issues :

Security issues fixed :

  - CVE-2018-0886: Fix a remote code execution vulnerability     (CredSSP) (bsc#1085416, bsc#1087240, bsc#1104918)

  - CVE-2018-8789: Fix several denial of service     vulnerabilities in the in the NTLM Authentication module     (bsc#1117965)

  - CVE-2018-8785: Fix a potential remote code execution     vulnerability in the zgfx_decompress function     (bsc#1117967)

  - CVE-2018-8786: Fix a potential remote code execution     vulnerability in the update_read_bitmap_update function     (bsc#1117966)

  - CVE-2018-8787: Fix a potential remote code execution     vulnerability in the gdi_Bitmap_Decompress function     (bsc#1117964)

  - CVE-2018-8788: Fix a potential remote code execution     vulnerability in the nsc_rle_decode function     (bsc#1117963)

  - CVE-2018-8784: Fix a potential remote code execution     vulnerability in the zgfx_decompress_segment function     (bsc#1116708)

  - CVE-2018-1000852: Fixed a remote memory access in the     drdynvc_process_capability_request function     (bsc#1120507)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for freerdp fixes the following issues :

Security issues fixed :

CVE-2018-0886: Fix a remote code execution vulnerability (CredSSP) (bsc#1085416, bsc#1087240, bsc#1104918)

CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication module (bsc#1117965)

CVE-2018-8785: Fix a potential remote code execution vulnerability in the zgfx_decompress function (bsc#1117967)

CVE-2018-8786: Fix a potential remote code execution vulnerability in the update_read_bitmap_update function (bsc#1117966)

CVE-2018-8787: Fix a potential remote code execution vulnerability in the gdi_Bitmap_Decompress function (bsc#1117964)

CVE-2018-8788: Fix a potential remote code execution vulnerability in the nsc_rle_decode function (bsc#1117963)

CVE-2018-8784: Fix a potential remote code execution vulnerability in the zgfx_decompress_segment function (bsc#1116708)

CVE-2018-1000852: Fixed a remote memory access in the drdynvc_process_capability_request function (bsc#1120507)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in the Credential     Security Support Provider protocol (CredSSP). An attacker who     successfully exploits this vulnerability could relay user     credentials and use them to execute code on the target host.
    (CVE-2018-0886)

  - An elevation of privilege vulnerability exists when the     Windows kernel fails to properly handle objects in     memory. An attacker who successfully exploited this     vulnerability could run arbitrary code in kernel mode.
    An attacker could then install programs; view, change,     or delete data; or create new accounts with full user     rights.  (CVE-2018-8897)

  - An elevation of privilege vulnerability exists when the     Windows Common Log File System (CLFS) driver improperly     handles objects in memory. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context.  (CVE-2018-8167)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-8120, CVE-2018-8124,     CVE-2018-8164, CVE-2018-8166)

  - A remote code execution vulnerability exists in     &quot;Microsoft COM for Windows&quot; when it fails to     properly handle serialized objects. An attacker who     successfully exploited the vulnerability could use a     specially crafted file or script to perform actions. In     an email attack scenario, an attacker could exploit the     vulnerability by sending the specially crafted file to     the user and convincing the user to open the file.
    (CVE-2018-0824)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2018-8174)

  - A remote code execution vulnerability exists when     Windows Hyper-V on a host server fails to properly     validate input from an authenticated user on a guest     operating system.  (CVE-2018-0959)

The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when     Windows Remote Assistance incorrectly processes XML     External Entities (XXE). An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2018-0878)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-0929)

  - A remote code execution vulnerability exists when     Windows Shell does not properly validate file copy     destinations. An attacker who successfully exploited the     vulnerability could run arbitrary code in the context of     the current user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2018-0883)


  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2018-0811, CVE-2018-0813, CVE-2018-0814)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2018-0885)

  - An information disclosure vulnerability exists in the     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (ASLR) bypass. An attacker who     successfully exploited the vulnerability could retrieve     the memory address of a kernel object.  (CVE-2018-0894,     CVE-2018-0895, CVE-2018-0896, CVE-2018-0897,     CVE-2018-0898, CVE-2018-0899, CVE-2018-0900,     CVE-2018-0901, CVE-2018-0904)

  - An elevation of privilege vulnerability exists in the     Windows Installer when the Windows Installer fails to     properly sanitize input leading to an insecure library     loading behavior. A locally authenticated attacker could     run arbitrary code with elevated system privileges. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting the input sanitization error to preclude     unintended elevation. (CVE-2018-0868)

  - A remote code execution vulnerability exists in the     Credential Security Support Provider protocol (CredSSP).
    An attacker who successfully exploited this     vulnerability could relay user credentials and use them     to execute code on the target system. CredSSP is an     authentication provider which processes authentication     requests for other applications; any application which     depends on CredSSP for authentication may be vulnerable     to this type of attack. As an example of how an attacker     would exploit this vulnerability against Remote Desktop     Protocol, the attacker would need to run a specially     crafted application and perform a man-in-the-middle     attack against a Remote Desktop Protocol session. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting how Credential Security Support Provider     protocol (CredSSP) validates requests during the     authentication process. To be fully protected against     this vulnerability users must enable Group Policy     settings on their systems and update their Remote     Desktop clients. The Group Policy settings are disabled     by default to prevent connectivity problems and users     must follow the instructions documented HERE to be fully     protected. (CVE-2018-0886)

  - An elevation of privilege vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0815, CVE-2018-0816,     CVE-2018-0817)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2018-0888)

The remote Windows host is missing security update 4088880 or cumulative update 4088877. It is, therefore, affected by multiple vulnerabilities :

  - An vulnerability exists within microprocessors utilizing     speculative execution and indirect branch prediction,     which may allow an attacker with local user access to     disclose information via a side-channel analysis.
    (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754)

  - An information disclosure vulnerability exists when     Windows Remote Assistance incorrectly processes XML     External Entities (XXE). An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2018-0878)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-0929)

  - A remote code execution vulnerability exists when     Windows Shell does not properly validate file copy     destinations. An attacker who successfully exploited the     vulnerability could run arbitrary code in the context of     the current user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2018-0883)

  - An elevation of privilege vulnerability exists in     Windows when the Microsoft Video Control mishandles     objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     system mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0881)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-0889, CVE-2018-0935)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2018-0811, CVE-2018-0813, CVE-2018-0814)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2018-0885)

  - A remote code execution vulnerability exists in the     Credential Security Support Provider protocol (CredSSP).
    An attacker who successfully exploited this     vulnerability could relay user credentials and use them     to execute code on the target system. CredSSP is an     authentication provider which processes authentication     requests for other applications; any application which     depends on CredSSP for authentication may be vulnerable     to this type of attack. As an example of how an attacker     would exploit this vulnerability against Remote Desktop     Protocol, the attacker would need to run a specially     crafted application and perform a man-in-the-middle     attack against a Remote Desktop Protocol session. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting how Credential Security Support Provider     protocol (CredSSP) validates requests during the     authentication process. To be fully protected against     this vulnerability users must enable Group Policy     settings on their systems and update their Remote     Desktop clients. The Group Policy settings are disabled     by default to prevent connectivity problems and users     must follow the instructions documented HERE to be fully     protected. (CVE-2018-0886)

  - An information disclosure vulnerability exists in the     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (ASLR) bypass. An attacker who     successfully exploited the vulnerability could retrieve     the memory address of a kernel object.  (CVE-2018-0894,     CVE-2018-0895, CVE-2018-0896, CVE-2018-0897,     CVE-2018-0898, CVE-2018-0899, CVE-2018-0900,     CVE-2018-0901, CVE-2018-0904)

  - An elevation of privilege vulnerability exists in the     Windows Installer when the Windows Installer fails to     properly sanitize input leading to an insecure library     loading behavior. A locally authenticated attacker could     run arbitrary code with elevated system privileges. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting the input sanitization error to preclude     unintended elevation. (CVE-2018-0868)

  - An elevation of privilege vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0816, CVE-2018-0817)

  - An information disclosure vulnerability exists when     affected Microsoft browsers improperly handle objects in     memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2018-0927)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2018-0888)

  - An information disclosure vulnerability exists when the     scripting engine does not properly handle objects in     memory in Microsoft browsers. An attacker who     successfully exploited the vulnerability could obtain     information to further compromise the users system.
    (CVE-2018-0891)

The remote Windows host is missing security update 4088879 or cumulative update 4088876. It is, therefore, affected by multiple vulnerabilities :

  - An vulnerability exists within microprocessors utilizing     speculative execution and indirect branch prediction,     which may allow an attacker with local user access to     disclose information via a side-channel analysis.
    (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754)

  - An information disclosure vulnerability exists when     Windows Remote Assistance incorrectly processes XML     External Entities (XXE). An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2018-0878)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-0929)

  - A remote code execution vulnerability exists when     Windows Shell does not properly validate file copy     destinations. An attacker who successfully exploited the     vulnerability could run arbitrary code in the context of     the current user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2018-0883)

  - An elevation of privilege vulnerability exists in     Windows when the Microsoft Video Control mishandles     objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     system mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0881)

  - An information disclosure vulnerability exists when     affected Microsoft browsers improperly handle objects in     memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2018-0927,     CVE-2018-0932)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-0889, CVE-2018-0935)

  - An elevation of privilege vulnerability exists when     Internet Explorer fails a check, allowing sandbox     escape. An attacker who successfully exploited the     vulnerability could use the sandbox escape to elevate     privileges on an affected system. This vulnerability by     itself does not allow arbitrary code execution; however,     it could allow arbitrary code to be run if the attacker     uses it in combination with another vulnerability (such     as a remote code execution vulnerability or another     elevation of privilege vulnerability) that is capable of     leveraging the elevated privileges when code execution     is attempted. The update addresses the vulnerability by     correcting how Internet Explorer handles zone and     integrity settings. (CVE-2018-0942)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2018-0811, CVE-2018-0813, CVE-2018-0814)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2018-0885)

  - A remote code execution vulnerability exists in the     Credential Security Support Provider protocol (CredSSP).
    An attacker who successfully exploited this     vulnerability could relay user credentials and use them     to execute code on the target system. CredSSP is an     authentication provider which processes authentication     requests for other applications; any application which     depends on CredSSP for authentication may be vulnerable     to this type of attack. As an example of how an attacker     would exploit this vulnerability against Remote Desktop     Protocol, the attacker would need to run a specially     crafted application and perform a man-in-the-middle     attack against a Remote Desktop Protocol session. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting how Credential Security Support Provider     protocol (CredSSP) validates requests during the     authentication process. To be fully protected against     this vulnerability users must enable Group Policy     settings on their systems and update their Remote     Desktop clients. The Group Policy settings are disabled     by default to prevent connectivity problems and users     must follow the instructions documented HERE to be fully     protected. (CVE-2018-0886)

  - An information disclosure vulnerability exists in the     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (ASLR) bypass. An attacker who     successfully exploited the vulnerability could retrieve     the memory address of a kernel object.  (CVE-2018-0894,     CVE-2018-0895, CVE-2018-0896, CVE-2018-0897,     CVE-2018-0898, CVE-2018-0899, CVE-2018-0900,     CVE-2018-0901, CVE-2018-0904)

  - An elevation of privilege vulnerability exists in the     Windows Installer when the Windows Installer fails to     properly sanitize input leading to an insecure library     loading behavior. A locally authenticated attacker could     run arbitrary code with elevated system privileges. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting the input sanitization error to preclude     unintended elevation. (CVE-2018-0868)

  - An elevation of privilege vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0816, CVE-2018-0817)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2018-0888)

  - An information disclosure vulnerability exists when the     scripting engine does not properly handle objects in     memory in Microsoft browsers. An attacker who     successfully exploited the vulnerability could obtain     information to further compromise the users system.
    (CVE-2018-0891)

The remote Windows host is missing security update 4088878 or cumulative update 4088875. It is, therefore, affected by multiple vulnerabilities :

  - An vulnerability exists within microprocessors utilizing     speculative execution and indirect branch prediction,     which may allow an attacker with local user access to     disclose information via a side-channel analysis.
    Note: this patch applies to only 32-bit Windows 7     systems.
    (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754)

  - An information disclosure vulnerability exists when     Windows Remote Assistance incorrectly processes XML     External Entities (XXE). An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2018-0878)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-0929)

  - A remote code execution vulnerability exists when     Windows Shell does not properly validate file copy     destinations. An attacker who successfully exploited the     vulnerability could run arbitrary code in the context of     the current user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2018-0883)

  - An elevation of privilege vulnerability exists in     Windows when the Microsoft Video Control mishandles     objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     system mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0881)

  - An information disclosure vulnerability exists when     affected Microsoft browsers improperly handle objects in     memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2018-0927,     CVE-2018-0932)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-0889, CVE-2018-0935)

  - An elevation of privilege vulnerability exists when     Internet Explorer fails a check, allowing sandbox     escape. An attacker who successfully exploited the     vulnerability could use the sandbox escape to elevate     privileges on an affected system. This vulnerability by     itself does not allow arbitrary code execution; however,     it could allow arbitrary code to be run if the attacker     uses it in combination with another vulnerability (such     as a remote code execution vulnerability or another     elevation of privilege vulnerability) that is capable of     leveraging the elevated privileges when code execution     is attempted. The update addresses the vulnerability by     correcting how Internet Explorer handles zone and     integrity settings. (CVE-2018-0942)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2018-0811, CVE-2018-0813, CVE-2018-0814)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2018-0885)

  - An information disclosure vulnerability exists in the     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (ASLR) bypass. An attacker who     successfully exploited the vulnerability could retrieve     the memory address of a kernel object.  (CVE-2018-0894,     CVE-2018-0895, CVE-2018-0896, CVE-2018-0897,     CVE-2018-0898, CVE-2018-0899, CVE-2018-0900,     CVE-2018-0901, CVE-2018-0904)

  - An elevation of privilege vulnerability exists in the     Windows Installer when the Windows Installer fails to     properly sanitize input leading to an insecure library     loading behavior. A locally authenticated attacker could     run arbitrary code with elevated system privileges. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting the input sanitization error to preclude     unintended elevation. (CVE-2018-0868)

  - A remote code execution vulnerability exists in the     Credential Security Support Provider protocol (CredSSP).
    An attacker who successfully exploited this     vulnerability could relay user credentials and use them     to execute code on the target system. CredSSP is an     authentication provider which processes authentication     requests for other applications; any application which     depends on CredSSP for authentication may be vulnerable     to this type of attack. As an example of how an attacker     would exploit this vulnerability against Remote Desktop     Protocol, the attacker would need to run a specially     crafted application and perform a man-in-the-middle     attack against a Remote Desktop Protocol session. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting how Credential Security Support Provider     protocol (CredSSP) validates requests during the     authentication process. To be fully protected against     this vulnerability users must enable Group Policy     settings on their systems and update their Remote     Desktop clients. The Group Policy settings are disabled     by default to prevent connectivity problems and users     must follow the instructions documented HERE to be fully     protected. (CVE-2018-0886)

  - An elevation of privilege vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0815, CVE-2018-0816,     CVE-2018-0817)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2018-0888)

  - An information disclosure vulnerability exists when the     scripting engine does not properly handle objects in     memory in Microsoft browsers. An attacker who     successfully exploited the vulnerability could obtain     information to further compromise the users system.
    (CVE-2018-0891)

The remote Windows host is missing security update 4088787.
It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists in     Windows when Desktop Bridge does not properly manage the     virtual registry. An attacker who successfully exploited     this vulnerability could run arbitrary code in kernel     mode. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-0880, CVE-2018-0882)

  - An elevation of privilege vulnerability exists when     Storage Services improperly handles objects in memory.
    An attacker who successfully exploited this     vulnerability could run processes in an elevated     context.  (CVE-2018-0983)

  - An information disclosure vulnerability exists in the     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (ASLR) bypass. An attacker who     successfully exploited the vulnerability could retrieve     the memory address of a kernel object.  (CVE-2018-0894,     CVE-2018-0895, CVE-2018-0896, CVE-2018-0897,     CVE-2018-0898, CVE-2018-0899, CVE-2018-0900,     CVE-2018-0901, CVE-2018-0904)

  - An elevation of privilege vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0816, CVE-2018-0817)

  - An elevation of privilege vulnerability exists in     Windows when the Windows kernel-mode driver fails to     properly handle objects in memory. An attacker who     successfully exploited this vulnerability could run     arbitrary code in kernel mode. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2018-0977)

  - A security feature bypass vulnerability exists in     Windows Scripting Host which could allow an attacker to     bypass Device Guard. An attacker who successfully     exploited this vulnerability could circumvent a User     Mode Code Integrity (UMCI) policy on the machine.
    (CVE-2018-0884)

  - An elevation of privilege vulnerability exists in     Windows when the Microsoft Video Control mishandles     objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     system mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0881)

  - An elevation of privilege vulnerability exists when     Internet Explorer fails a check, allowing sandbox     escape. An attacker who successfully exploited the     vulnerability could use the sandbox escape to elevate     privileges on an affected system. This vulnerability by     itself does not allow arbitrary code execution; however,     it could allow arbitrary code to be run if the attacker     uses it in combination with another vulnerability (such     as a remote code execution vulnerability or another     elevation of privilege vulnerability) that is capable of     leveraging the elevated privileges when code execution     is attempted. The update addresses the vulnerability by     correcting how Internet Explorer handles zone and     integrity settings. (CVE-2018-0942)

  - A remote code execution vulnerability exists in the     Credential Security Support Provider protocol (CredSSP).
    An attacker who successfully exploited this     vulnerability could relay user credentials and use them     to execute code on the target system. CredSSP is an     authentication provider which processes authentication     requests for other applications; any application which     depends on CredSSP for authentication may be vulnerable     to this type of attack. As an example of how an attacker     would exploit this vulnerability against Remote Desktop     Protocol, the attacker would need to run a specially     crafted application and perform a man-in-the-middle     attack against a Remote Desktop Protocol session. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting how Credential Security Support Provider     protocol (CredSSP) validates requests during the     authentication process. To be fully protected against     this vulnerability users must enable Group Policy     settings on their systems and update their Remote     Desktop clients. The Group Policy settings are disabled     by default to prevent connectivity problems and users     must follow the instructions documented HERE to be fully     protected. (CVE-2018-0886)

  - An information disclosure vulnerability exists when the     scripting engine does not properly handle objects in     memory in Microsoft browsers. An attacker who     successfully exploited the vulnerability could obtain     information to further compromise the users system.
    (CVE-2018-0891)

  - A remote code execution vulnerability exists when     Windows Shell does not properly validate file copy     destinations. An attacker who successfully exploited the     vulnerability could run arbitrary code in the context of     the current user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2018-0883)

  - An information disclosure vulnerability exists when     affected Microsoft browsers improperly handle objects in     memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2018-0927,     CVE-2018-0932)

  - A security feature bypass vulnerability exists in the     Cryptography Next Generation (CNG) kernel-mode driver     (cng.sys) when it fails to properly validate and enforce     impersonation levels. An attacker could exploit this     vulnerability by convincing a user to run a specially     crafted application that is designed to cause CNG to     improperly validate impersonation levels, potentially     allowing the attacker to gain access to information     beyond the access level of the local user. The security     update addresses the vulnerability by correcting how the     kernel-mode driver validates and enforces impersonation     levels. (CVE-2018-0902)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2018-0888)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Microsoft Edge. The vulnerability could corrupt memory     in such a way that an attacker could execute arbitrary     code in the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2018-0876,     CVE-2018-0893)

  - An information disclosure vulnerability exists when     Windows Remote Assistance incorrectly processes XML     External Entities (XXE). An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2018-0878)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-0929)

  - An elevation of privilege vulnerability exists in     Windows when the Desktop Bridge VFS does not take into     acccount user/kernel mode when managing file paths. An     attacker who successfully exploited this vulnerability     could run arbitrary code in kernel mode. An attacker     could then install programs; view, change, or delete     data; or create new accounts with full user rights.
    (CVE-2018-0877)

  - An elevation of privilege vulnerability exists in the     Windows Installer when the Windows Installer fails to     properly sanitize input leading to an insecure library     loading behavior. A locally authenticated attacker could     run arbitrary code with elevated system privileges. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting the input sanitization error to preclude     unintended elevation. (CVE-2018-0868)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2018-0885)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-0889, CVE-2018-0935)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2018-0811, CVE-2018-0813, CVE-2018-0814,     CVE-2018-0926)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2018-0872, CVE-2018-0873,     CVE-2018-0874, CVE-2018-0931, CVE-2018-0933,     CVE-2018-0934)

The remote Windows host is missing security update 4088786.
It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when     Windows Remote Assistance incorrectly processes XML     External Entities (XXE). An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2018-0878)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-0929)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Microsoft Edge. The vulnerability could corrupt memory     in such a way that an attacker could execute arbitrary     code in the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2018-0876)

  - An elevation of privilege vulnerability exists in     Windows when the Microsoft Video Control mishandles     objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     system mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0881)

  - An information disclosure vulnerability exists when     affected Microsoft browsers improperly handle objects in     memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2018-0927,     CVE-2018-0932)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-0889, CVE-2018-0935)

  - An elevation of privilege vulnerability exists when     Internet Explorer fails a check, allowing sandbox     escape. An attacker who successfully exploited the     vulnerability could use the sandbox escape to elevate     privileges on an affected system. This vulnerability by     itself does not allow arbitrary code execution; however,     it could allow arbitrary code to be run if the attacker     uses it in combination with another vulnerability (such     as a remote code execution vulnerability or another     elevation of privilege vulnerability) that is capable of     leveraging the elevated privileges when code execution     is attempted. The update addresses the vulnerability by     correcting how Internet Explorer handles zone and     integrity settings. (CVE-2018-0942)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2018-0872, CVE-2018-0874,     CVE-2018-0931, CVE-2018-0933, CVE-2018-0934)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2018-0811, CVE-2018-0813, CVE-2018-0814)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2018-0885)

  - A remote code execution vulnerability exists in the     Credential Security Support Provider protocol (CredSSP).
    An attacker who successfully exploited this     vulnerability could relay user credentials and use them     to execute code on the target system. CredSSP is an     authentication provider which processes authentication     requests for other applications; any application which     depends on CredSSP for authentication may be vulnerable     to this type of attack. As an example of how an attacker     would exploit this vulnerability against Remote Desktop     Protocol, the attacker would need to run a specially     crafted application and perform a man-in-the-middle     attack against a Remote Desktop Protocol session. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting how Credential Security Support Provider     protocol (CredSSP) validates requests during the     authentication process. To be fully protected against     this vulnerability users must enable Group Policy     settings on their systems and update their Remote     Desktop clients. The Group Policy settings are disabled     by default to prevent connectivity problems and users     must follow the instructions documented HERE to be fully     protected. (CVE-2018-0886)

  - An information disclosure vulnerability exists in the     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (ASLR) bypass. An attacker who     successfully exploited the vulnerability could retrieve     the memory address of a kernel object.  (CVE-2018-0894,     CVE-2018-0895, CVE-2018-0896, CVE-2018-0897,     CVE-2018-0898, CVE-2018-0899, CVE-2018-0900,     CVE-2018-0901, CVE-2018-0904)

  - An elevation of privilege vulnerability exists in the     Windows Installer when the Windows Installer fails to     properly sanitize input leading to an insecure library     loading behavior. A locally authenticated attacker could     run arbitrary code with elevated system privileges. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting the input sanitization error to preclude     unintended elevation. (CVE-2018-0868)

  - An elevation of privilege vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0816, CVE-2018-0817)

  - A remote code execution vulnerability exists when     Windows Shell does not properly validate file copy     destinations. An attacker who successfully exploited the     vulnerability could run arbitrary code in the context of     the current user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2018-0883)

  - An elevation of privilege vulnerability exists in     Windows when the Windows kernel-mode driver fails to     properly handle objects in memory. An attacker who     successfully exploited this vulnerability could run     arbitrary code in kernel mode. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2018-0977)

  - A security feature bypass vulnerability exists in     Windows Scripting Host which could allow an attacker to     bypass Device Guard. An attacker who successfully     exploited this vulnerability could circumvent a User     Mode Code Integrity (UMCI) policy on the machine.
    (CVE-2018-0884)

  - A security feature bypass vulnerability exists in the     Cryptography Next Generation (CNG) kernel-mode driver     (cng.sys) when it fails to properly validate and enforce     impersonation levels. An attacker could exploit this     vulnerability by convincing a user to run a specially     crafted application that is designed to cause CNG to     improperly validate impersonation levels, potentially     allowing the attacker to gain access to information     beyond the access level of the local user. The security     update addresses the vulnerability by correcting how the     kernel-mode driver validates and enforces impersonation     levels. (CVE-2018-0902)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2018-0888)

  - An information disclosure vulnerability exists when the     scripting engine does not properly handle objects in     memory in Microsoft browsers. An attacker who     successfully exploited the vulnerability could obtain     information to further compromise the users system.
    (CVE-2018-0891)

The remote Windows host is missing security update 4088782.
It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists in     Windows when Desktop Bridge does not properly manage the     virtual registry. An attacker who successfully exploited     this vulnerability could run arbitrary code in kernel     mode. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-0880, CVE-2018-0882)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2018-0872, CVE-2018-0873,     CVE-2018-0874, CVE-2018-0931, CVE-2018-0933,     CVE-2018-0934, CVE-2018-0937)

  - An elevation of privilege vulnerability exists when     Storage Services improperly handles objects in memory.
    An attacker who successfully exploited this     vulnerability could run processes in an elevated     context.  (CVE-2018-0983)

  - An information disclosure vulnerability exists in the     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (ASLR) bypass. An attacker who     successfully exploited the vulnerability could retrieve     the memory address of a kernel object.  (CVE-2018-0894,     CVE-2018-0895, CVE-2018-0896, CVE-2018-0897,     CVE-2018-0898, CVE-2018-0899, CVE-2018-0900,     CVE-2018-0901, CVE-2018-0904)

  - An elevation of privilege vulnerability exists in     Windows when the Windows kernel-mode driver fails to     properly handle objects in memory. An attacker who     successfully exploited this vulnerability could run     arbitrary code in kernel mode. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2018-0977)

  - A security feature bypass vulnerability exists in     Windows Scripting Host which could allow an attacker to     bypass Device Guard. An attacker who successfully     exploited this vulnerability could circumvent a User     Mode Code Integrity (UMCI) policy on the machine.
    (CVE-2018-0884)

  - An information disclosure vulnerability exists when the     scripting engine does not properly handle objects in     memory in Microsoft Edge. An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2018-0939)

  - An elevation of privilege vulnerability exists in     Windows when the Microsoft Video Control mishandles     objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     system mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0881)

  - An elevation of privilege vulnerability exists when     Internet Explorer fails a check, allowing sandbox     escape. An attacker who successfully exploited the     vulnerability could use the sandbox escape to elevate     privileges on an affected system. This vulnerability by     itself does not allow arbitrary code execution; however,     it could allow arbitrary code to be run if the attacker     uses it in combination with another vulnerability (such     as a remote code execution vulnerability or another     elevation of privilege vulnerability) that is capable of     leveraging the elevated privileges when code execution     is attempted. The update addresses the vulnerability by     correcting how Internet Explorer handles zone and     integrity settings. (CVE-2018-0942)

  - A remote code execution vulnerability exists in the     Credential Security Support Provider protocol (CredSSP).
    An attacker who successfully exploited this     vulnerability could relay user credentials and use them     to execute code on the target system. CredSSP is an     authentication provider which processes authentication     requests for other applications; any application which     depends on CredSSP for authentication may be vulnerable     to this type of attack. As an example of how an attacker     would exploit this vulnerability against Remote Desktop     Protocol, the attacker would need to run a specially     crafted application and perform a man-in-the-middle     attack against a Remote Desktop Protocol session. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting how Credential Security Support Provider     protocol (CredSSP) validates requests during the     authentication process. To be fully protected against     this vulnerability users must enable Group Policy     settings on their systems and update their Remote     Desktop clients. The Group Policy settings are disabled     by default to prevent connectivity problems and users     must follow the instructions documented HERE to be fully     protected. (CVE-2018-0886)

  - An information disclosure vulnerability exists when the     scripting engine does not properly handle objects in     memory in Microsoft browsers. An attacker who     successfully exploited the vulnerability could obtain     information to further compromise the users system.
    (CVE-2018-0891)

  - A remote code execution vulnerability exists when     Windows Shell does not properly validate file copy     destinations. An attacker who successfully exploited the     vulnerability could run arbitrary code in the context of     the current user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2018-0883)

  - An information disclosure vulnerability exists when     affected Microsoft browsers improperly handle objects in     memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2018-0927,     CVE-2018-0932)

  - A security feature bypass vulnerability exists in the     Cryptography Next Generation (CNG) kernel-mode driver     (cng.sys) when it fails to properly validate and enforce     impersonation levels. An attacker could exploit this     vulnerability by convincing a user to run a specially     crafted application that is designed to cause CNG to     improperly validate impersonation levels, potentially     allowing the attacker to gain access to information     beyond the access level of the local user. The security     update addresses the vulnerability by correcting how the     kernel-mode driver validates and enforces impersonation     levels. (CVE-2018-0902)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2018-0888)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Microsoft Edge. The vulnerability could corrupt memory     in such a way that an attacker could execute arbitrary     code in the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2018-0876,     CVE-2018-0893)

  - An information disclosure vulnerability exists when     Windows Remote Assistance incorrectly processes XML     External Entities (XXE). An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2018-0878)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-0929)

  - An elevation of privilege vulnerability exists in     Windows when the Desktop Bridge VFS does not take into     acccount user/kernel mode when managing file paths. An     attacker who successfully exploited this vulnerability     could run arbitrary code in kernel mode. An attacker     could then install programs; view, change, or delete     data; or create new accounts with full user rights.
    (CVE-2018-0877)

  - An elevation of privilege vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0817)

  - An elevation of privilege vulnerability exists in the     Windows Installer when the Windows Installer fails to     properly sanitize input leading to an insecure library     loading behavior. A locally authenticated attacker could     run arbitrary code with elevated system privileges. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting the input sanitization error to preclude     unintended elevation. (CVE-2018-0868)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2018-0885)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-0889, CVE-2018-0935)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2018-0811, CVE-2018-0813, CVE-2018-0814,     CVE-2018-0926)

The remote Windows host is missing security update 4088779.
It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when     Windows Remote Assistance incorrectly processes XML     External Entities (XXE). An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2018-0878)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-0929)

  - A remote code execution vulnerability exists when     Windows Shell does not properly validate file copy     destinations. An attacker who successfully exploited the     vulnerability could run arbitrary code in the context of     the current user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2018-0883)

  - An elevation of privilege vulnerability exists in     Windows when the Microsoft Video Control mishandles     objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     system mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0881)

  - An information disclosure vulnerability exists when     affected Microsoft browsers improperly handle objects in     memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2018-0927,     CVE-2018-0932)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-0889, CVE-2018-0935)

  - An elevation of privilege vulnerability exists when     Internet Explorer fails a check, allowing sandbox     escape. An attacker who successfully exploited the     vulnerability could use the sandbox escape to elevate     privileges on an affected system. This vulnerability by     itself does not allow arbitrary code execution; however,     it could allow arbitrary code to be run if the attacker     uses it in combination with another vulnerability (such     as a remote code execution vulnerability or another     elevation of privilege vulnerability) that is capable of     leveraging the elevated privileges when code execution     is attempted. The update addresses the vulnerability by     correcting how Internet Explorer handles zone and     integrity settings. (CVE-2018-0942)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2018-0811, CVE-2018-0813, CVE-2018-0814)

  - An elevation of privilege vulnerability exists when     Storage Services improperly handles objects in memory.
    An attacker who successfully exploited this     vulnerability could run processes in an elevated     context.  (CVE-2018-0983)

  - A remote code execution vulnerability exists in the     Credential Security Support Provider protocol (CredSSP).
    An attacker who successfully exploited this     vulnerability could relay user credentials and use them     to execute code on the target system. CredSSP is an     authentication provider which processes authentication     requests for other applications; any application which     depends on CredSSP for authentication may be vulnerable     to this type of attack. As an example of how an attacker     would exploit this vulnerability against Remote Desktop     Protocol, the attacker would need to run a specially     crafted application and perform a man-in-the-middle     attack against a Remote Desktop Protocol session. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting how Credential Security Support Provider     protocol (CredSSP) validates requests during the     authentication process. To be fully protected against     this vulnerability users must enable Group Policy     settings on their systems and update their Remote     Desktop clients. The Group Policy settings are disabled     by default to prevent connectivity problems and users     must follow the instructions documented HERE to be fully     protected. (CVE-2018-0886)

  - An information disclosure vulnerability exists in the     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (ASLR) bypass. An attacker who     successfully exploited the vulnerability could retrieve     the memory address of a kernel object.  (CVE-2018-0894,     CVE-2018-0895, CVE-2018-0896, CVE-2018-0897,     CVE-2018-0898, CVE-2018-0899, CVE-2018-0900,     CVE-2018-0901, CVE-2018-0904)

  - An elevation of privilege vulnerability exists in the     Windows Installer when the Windows Installer fails to     properly sanitize input leading to an insecure library     loading behavior. A locally authenticated attacker could     run arbitrary code with elevated system privileges. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting the input sanitization error to preclude     unintended elevation. (CVE-2018-0868)

  - An elevation of privilege vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0816, CVE-2018-0817)

  - An elevation of privilege vulnerability exists in     Windows when the Windows kernel-mode driver fails to     properly handle objects in memory. An attacker who     successfully exploited this vulnerability could run     arbitrary code in kernel mode. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2018-0977)

  - A security feature bypass vulnerability exists in     Windows Scripting Host which could allow an attacker to     bypass Device Guard. An attacker who successfully     exploited this vulnerability could circumvent a User     Mode Code Integrity (UMCI) policy on the machine.
    (CVE-2018-0884)

  - A security feature bypass vulnerability exists in the     Cryptography Next Generation (CNG) kernel-mode driver     (cng.sys) when it fails to properly validate and enforce     impersonation levels. An attacker could exploit this     vulnerability by convincing a user to run a specially     crafted application that is designed to cause CNG to     improperly validate impersonation levels, potentially     allowing the attacker to gain access to information     beyond the access level of the local user. The security     update addresses the vulnerability by correcting how the     kernel-mode driver validates and enforces impersonation     levels. (CVE-2018-0902)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2018-0888)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Microsoft Edge. The vulnerability could corrupt memory     in such a way that an attacker could execute arbitrary     code in the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2018-0876,     CVE-2018-0893)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2018-0885)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2018-0872, CVE-2018-0873,     CVE-2018-0874, CVE-2018-0931, CVE-2018-0933,     CVE-2018-0934)

  - An information disclosure vulnerability exists when the     scripting engine does not properly handle objects in     memory in Microsoft browsers. An attacker who     successfully exploited the vulnerability could obtain     information to further compromise the users system.
    (CVE-2018-0891)

The remote Windows host is missing security update 4088776.
It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when     Microsoft Edge improperly handles objects in memory. An     attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-0879)

  - An elevation of privilege vulnerability exists when     Storage Services improperly handles objects in memory.
    An attacker who successfully exploited this     vulnerability could run processes in an elevated     context.  (CVE-2018-0983)

  - An information disclosure vulnerability exists in the     Windows kernel that could allow an attacker to retrieve     information that could lead to a Kernel Address Space     Layout Randomization (ASLR) bypass. An attacker who     successfully exploited the vulnerability could retrieve     the memory address of a kernel object.  (CVE-2018-0894,     CVE-2018-0895, CVE-2018-0896, CVE-2018-0897,     CVE-2018-0898, CVE-2018-0899, CVE-2018-0900,     CVE-2018-0901, CVE-2018-0904)

  - An elevation of privilege vulnerability exists in     Windows when the Windows kernel-mode driver fails to     properly handle objects in memory. An attacker who     successfully exploited this vulnerability could run     arbitrary code in kernel mode. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2018-0977)

  - A security feature bypass vulnerability exists in     Windows Scripting Host which could allow an attacker to     bypass Device Guard. An attacker who successfully     exploited this vulnerability could circumvent a User     Mode Code Integrity (UMCI) policy on the machine.
    (CVE-2018-0884)

  - An information disclosure vulnerability exists when the     scripting engine does not properly handle objects in     memory in Microsoft Edge. An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2018-0939)

  - An elevation of privilege vulnerability exists in     Windows when the Microsoft Video Control mishandles     objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     system mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0881)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2018-0872, CVE-2018-0873,     CVE-2018-0874, CVE-2018-0930, CVE-2018-0931,     CVE-2018-0933, CVE-2018-0934, CVE-2018-0936,     CVE-2018-0937)

  - A remote code execution vulnerability exists in the     Credential Security Support Provider protocol (CredSSP).
    An attacker who successfully exploited this     vulnerability could relay user credentials and use them     to execute code on the target system. CredSSP is an     authentication provider which processes authentication     requests for other applications; any application which     depends on CredSSP for authentication may be vulnerable     to this type of attack. As an example of how an attacker     would exploit this vulnerability against Remote Desktop     Protocol, the attacker would need to run a specially     crafted application and perform a man-in-the-middle     attack against a Remote Desktop Protocol session. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting how Credential Security Support Provider     protocol (CredSSP) validates requests during the     authentication process. To be fully protected against     this vulnerability users must enable Group Policy     settings on their systems and update their Remote     Desktop clients. The Group Policy settings are disabled     by default to prevent connectivity problems and users     must follow the instructions documented HERE to be fully     protected. (CVE-2018-0886)

  - An information disclosure vulnerability exists when the     scripting engine does not properly handle objects in     memory in Microsoft browsers. An attacker who     successfully exploited the vulnerability could obtain     information to further compromise the users system.
    (CVE-2018-0891)

  - A remote code execution vulnerability exists when     Windows Shell does not properly validate file copy     destinations. An attacker who successfully exploited the     vulnerability could run arbitrary code in the context of     the current user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2018-0883)

  - An information disclosure vulnerability exists when     affected Microsoft browsers improperly handle objects in     memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2018-0927,     CVE-2018-0932)

  - A security feature bypass vulnerability exists in the     Cryptography Next Generation (CNG) kernel-mode driver     (cng.sys) when it fails to properly validate and enforce     impersonation levels. An attacker could exploit this     vulnerability by convincing a user to run a specially     crafted application that is designed to cause CNG to     improperly validate impersonation levels, potentially     allowing the attacker to gain access to information     beyond the access level of the local user. The security     update addresses the vulnerability by correcting how the     kernel-mode driver validates and enforces impersonation     levels. (CVE-2018-0902)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2018-0888)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Microsoft Edge. The vulnerability could corrupt memory     in such a way that an attacker could execute arbitrary     code in the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2018-0876,     CVE-2018-0893)

  - An information disclosure vulnerability exists when     Windows Remote Assistance incorrectly processes XML     External Entities (XXE). An attacker who successfully     exploited the vulnerability could obtain information to     further compromise the users system.  (CVE-2018-0878)

  - An elevation of privilege vulnerability exists in     Windows when Desktop Bridge does not properly manage the     virtual registry. An attacker who successfully exploited     this vulnerability could run arbitrary code in kernel     mode. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-0880)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-0929)

  - An elevation of privilege vulnerability exists in     Windows when the Desktop Bridge VFS does not take into     acccount user/kernel mode when managing file paths. An     attacker who successfully exploited this vulnerability     could run arbitrary code in kernel mode. An attacker     could then install programs; view, change, or delete     data; or create new accounts with full user rights.
    (CVE-2018-0877)

  - An elevation of privilege vulnerability exists in the     way that the Windows Graphics Device Interface (GDI)     handles objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-0817)

  - An elevation of privilege vulnerability exists in the     Windows Installer when the Windows Installer fails to     properly sanitize input leading to an insecure library     loading behavior. A locally authenticated attacker could     run arbitrary code with elevated system privileges. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting the input sanitization error to preclude     unintended elevation. (CVE-2018-0868)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2018-0885)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-0889, CVE-2018-0935)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2018-0811, CVE-2018-0813, CVE-2018-0814,     CVE-2018-0926)

ID	Name	Product	Family	Severity
128764	CredSSP Remote Code Execution Vulnerability March 2018 Security Update	Nessus	Windows	high
122847	openSUSE Security Update : freerdp (openSUSE-2019-325)	Nessus	SuSE Local Security Checks	critical
122608	SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2019:0539-1)	Nessus	SuSE Local Security Checks	critical
121462	openSUSE Security Update : freerdp (openSUSE-2019-96)	Nessus	SuSE Local Security Checks	critical
121302	SUSE SLED12 Security Update : freerdp (SUSE-SU-2019:0134-1)	Nessus	SuSE Local Security Checks	critical
109651	Security Updates for Windows Server 2008 (May 2018)	Nessus	Windows : Microsoft Bulletins	high
108300	Security Updates for Windows Server 2008 (March 2018)	Nessus	Windows : Microsoft Bulletins	high
108292	KB4088880: Windows Server 2012 March 2018 Security Update (Meltdown)(Spectre)	Nessus	Windows : Microsoft Bulletins	high
108291	KB4088879: Windows 8.1 and Windows Server 2012 R2 March 2018 Security Update (Meltdown)(Spectre)	Nessus	Windows : Microsoft Bulletins	high
108290	KB4088878: Windows 7 and Windows Server 2008 R2 March 2018 Security Update (Meltdown)(Spectre)	Nessus	Windows : Microsoft Bulletins	high
108289	KB4088787: Windows 10 Version 1607 and Windows Server 2016 March 2018 Security Update	Nessus	Windows : Microsoft Bulletins	high
108288	KB4088786: Windows 10 March 2018 Security Update	Nessus	Windows : Microsoft Bulletins	high
108286	KB4088782: Windows 10 Version 1703 March 2018 Security Update	Nessus	Windows : Microsoft Bulletins	high
108285	KB4088779: Windows 10 Version 1511 March 2018 Security Update	Nessus	Windows : Microsoft Bulletins	high
108284	KB4088776: Windows 10 Version 1709 and Windows Server Version 1709 March 2018 Security Update	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2018-0886

high

Tenable Plugins

high

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high