Windows 2008 May 2017 Multiple Security Updates

Critical Nessus Plugin ID 100063

Synopsis

The remote Windows host is affected by multiple vulnerabilities.

Description

The remote Windows host is missing multiple security updates released
on 2017/05/09. It is, therefore, affected by multiple
vulnerabilities :

- An elevation of privilege vulnerability exists when the
Windows improperly handles objects in memory.
(CVE-2017-0077)

- A denial of service vulnerability exists in Windows DNS
Server if the server is configured to answer version
queries. An attacker who successfully exploited this
vulnerability could cause the DNS Server service to
become nonresponsive. (CVE-2017-0171)

- An information disclosure vulnerability exists in the
way that the Windows Graphics Device Interface+ (GDI+)
handles objects in memory, allowing an attacker to
retrieve information from a targeted system.
(CVE-2017-0190)

- An elevation of privilege vulnerability exists in the
Windows COM Aggregate Marshaler due to an unspecified
flaw. A local attacker can exploit this, via a specially
crafted application, to execute arbitrary code with
elevated privileges. (CVE-2017-0213)

- An elevation of privilege vulnerability exists in
Windows due to improper validation of user-supplied
input when loading type libraries. A local attacker can
exploit this, via a specially crafted application, to
gain elevated privileges. (CVE-2017-0214)

- An information disclosure vulnerability exists in the
Windows kernel due to improper handling of objects in
memory. A local attacker can exploit this, via a
specially crafted application, to disclose sensitive
information. (CVE-2017-0175, CVE-2017-0220)

- An information disclosure vulnerability exists in the
way some ActiveX objects are instantiated. An attacker
who successfully exploited this vulnerability could gain
access to protected memory contents. (CVE-2017-0242)

- An elevation of privilege vulnerability exists in the
way that the Windows Kernel handles objects in memory.
An attacker who successfully exploited the vulnerability
could execute code with elevated permissions. On systems
with Windows 7 for x64-based Systems or later installed,
this vulnerability can lead to denial of service.
(CVE-2017-0244)

- An information disclosure vulnerability exists when the
win32k component improperly provides kernel information.
An attacker who successfully exploited the vulnerability
could obtain information to further compromise the users
system. (CVE-2017-0245)

- An elevation of privilege vulnerability exists when
Windows improperly handles objects in memory. An
attacker who successfully exploited this vulnerability
could run processes in an elevated context. On computers
with Windows 7 for x64-based systems or later installed,
this vulnerability can lead to denial of service.
(CVE-2017-0246)

- An information disclosure vulnerability exists when the
Windows kernel improperly initializes objects in memory.
(CVE-2017-0258)

- An elevation of privilege vulnerability exists in
Windows when the Windows kernel-mode driver fails to
properly handle objects in memory.
(CVE-2017-0263)

- An information disclosure vulnerability exists in the
Microsoft Server Message Block 1.0 (SMBv1) server when
handling certain requests. An unauthenticated, remote
attacker can exploit this, via a specially crafted
packet, to disclose sensitive information.
(CVE-2017-0267)

- An information disclosure vulnerability exists in the
Microsoft Server Message Block 1.0 (SMBv1) server when
handling certain requests. An unauthenticated, remote
attacker can exploit this, via a specially crafted
packet, to disclose sensitive information.
(CVE-2017-0268)

- A denial of service vulnerability exists in Microsoft
Server Message Block (SMB) when handling a specially
crafted request to the server. An unauthenticated,
remote attacker can exploit this, via a crafted SMB
request, to cause the system to stop responding.
(CVE-2017-0269)

- An information disclosure vulnerability exists in the
Microsoft Server Message Block 1.0 (SMBv1) server when
handling certain requests. An unauthenticated, remote
attacker can exploit this, via a specially crafted
packet, to disclose sensitive information.
(CVE-2017-0270)

- An information disclosure vulnerability exists in the
Microsoft Server Message Block 1.0 (SMBv1) server when
handling certain requests. An unauthenticated, remote
attacker can exploit this, via a specially crafted
packet, to disclose sensitive information.
(CVE-2017-0271)

- A remote code execution vulnerability exists in the
Microsoft Server Message Block 1.0 (SMBv1) server when
handling certain requests. An unauthenticated, remote
attacker can exploit this, via a specially crafted
packet, to execute arbitrary code on a target server.
(CVE-2017-0272)

- A denial of service vulnerability exists in Microsoft
Server Message Block (SMB) when handling a specially
crafted request to the server. An unauthenticated,
remote attacker can exploit this, via a crafted SMB
request, to cause the system to stop responding.
(CVE-2017-0273)

- An information disclosure vulnerability exists in the
Microsoft Server Message Block 1.0 (SMBv1) server when
handling certain requests. An unauthenticated, remote
attacker can exploit this, via a specially crafted
packet, to disclose sensitive information.
(CVE-2017-0274)

- An information disclosure vulnerability exists in the
Microsoft Server Message Block 1.0 (SMBv1) server when
handling certain requests. An unauthenticated, remote
attacker can exploit this, via a specially crafted
packet, to disclose sensitive information.
(CVE-2017-0275)

- An information disclosure vulnerability exists in the
Microsoft Server Message Block 1.0 (SMBv1) server when
handling certain requests. An unauthenticated, remote
attacker can exploit this, via a specially crafted
packet, to disclose sensitive information.
(CVE-2017-0276)

- A remote code execution vulnerability exists in the
Microsoft Server Message Block 1.0 (SMBv1) server when
handling certain requests. An unauthenticated, remote
attacker can exploit this, via a specially crafted
packet, to execute arbitrary code on a target server.
(CVE-2017-0277)

- A remote code execution vulnerability exists in the
Microsoft Server Message Block 1.0 (SMBv1) server when
handling certain requests. An unauthenticated, remote
attacker can exploit this, via a specially crafted
packet, to execute arbitrary code on a target server.
(CVE-2017-0278)

- A remote code execution vulnerability exists in the
Microsoft Server Message Block 1.0 (SMBv1) server when
handling certain requests. An unauthenticated, remote
attacker can exploit this, via a specially crafted
packet, to execute arbitrary code on a target server.
(CVE-2017-0279)

- A denial of service vulnerability exists in Microsoft
Server Message Block (SMB) when handling a specially
crafted request to the server. An unauthenticated,
remote attacker can exploit this, via a crafted SMB
request, to cause the system to stop responding.
(CVE-2017-0280)

- An information disclosure vulnerability exists in the
GDI component due to improper handling of objects in
memory. An unauthenticated, remote attacker can exploit
this, by convincing a user to open a specially crafted
document or visit a specially crafted website, to
disclose the contents of memory. (CVE-2017-8552)

Solution

Apply the following security updates :

- KB4018196
- KB4018466
- KB4018556
- KB4018821
- KB4018885
- KB4018927
- KB4019149
- KB4019204
- KB4019206

See Also

https://support.microsoft.com/en-us/help/4018196/title

https://support.microsoft.com/en-us/help/4018466/title

https://support.microsoft.com/en-us/help/4018556/title

https://support.microsoft.com/en-us/help/4018821/title

https://support.microsoft.com/en-us/help/4018885/title

https://support.microsoft.com/en-us/help/4018927/title

https://support.microsoft.com/en-us/help/4019149/title

https://support.microsoft.com/en-us/help/4019204/title

https://support.microsoft.com/en-us/help/4019206/title

Plugin Details

Severity: Critical

ID: 100063

File Name: smb_nt_ms17_may_win2008.nasl

Version: 1.15

Type: local

Agent: windows

Published: 2017/05/09

Modified: 2018/07/30

Dependencies: 93962, 13855, 57033

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/05/09

Vulnerability Publication Date: 2017/05/09

Exploitable With

Core Impact

Reference Information

CVE: CVE-2017-0077, CVE-2017-0171, CVE-2017-0175, CVE-2017-0190, CVE-2017-0213, CVE-2017-0214, CVE-2017-0220, CVE-2017-0242, CVE-2017-0244, CVE-2017-0245, CVE-2017-0246, CVE-2017-0258, CVE-2017-0263, CVE-2017-0267, CVE-2017-0268, CVE-2017-0269, CVE-2017-0270, CVE-2017-0271, CVE-2017-0272, CVE-2017-0273, CVE-2017-0274, CVE-2017-0275, CVE-2017-0276, CVE-2017-0277, CVE-2017-0278, CVE-2017-0279, CVE-2017-0280, CVE-2017-8552

BID: 98097, 98102, 98103, 98108, 98109, 98110, 98111, 98112, 98114, 98115, 98258, 98259, 98260, 98261, 98263, 98264, 98265, 98266, 98267, 98268, 98270, 98271, 98272, 98273, 98274, 98275, 98298

MSKB: 4018196, 4018466, 4018556, 4018821, 4018885, 4018927, 4019149, 4019204, 4019206

MSFT: MS17-4018196, MS17-4018466, MS17-4018556, MS17-4018821, MS17-4018885, MS17-4018927, MS17-4019149, MS17-4019204, MS17-4019206

IAVA: 2017-A-0148