The remote Windows host is missing security update KB4025339. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     Windows Performance Monitor Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to create a     Data Collector Set and import a specially crafted XML     file, to disclose arbitrary files via an XML external     entity (XXE) declaration. (CVE-2017-0170)

  - A remote code execution vulnerability exists in Windows     Explorer due to improper handling of executable files     and shares during rename operations. An unauthenticated,     remote attacker can exploit this, by convincing a user     to open a specially crafted file, to execute arbitrary     code in the context of the current user. (CVE-2017-8463)

  - Multiple elevation of privilege vulnerabilities exist in     the Microsoft Graphics component due to improper     handling of objects in memory. A local attacker can     exploit these, via a specially crafted application, to     run arbitrary code in kernel mode. (CVE-2017-8467,     CVE-2017-8556, CVE-2017-8573, CVE-2017-8574,     CVE-2017-8577, CVE-2017-8578, CVE-2017-8580)

  - An information disclosure vulnerability exists in Win32k     due to improper handling of objects in memory. A local     attacker can exploit this, via a specially crafted     application, to disclose sensitive information.
    (CVE-2017-8486)

  - A security bypass vulnerability exists in Microsoft     Windows when handling Kerberos ticket exchanges due to a     failure to prevent tampering with the SNAME field. A     man-in-the-middle attacker can exploit this to bypass     the Extended Protection for Authentication security     feature. (CVE-2017-8495)

  - An information disclosure vulnerability exists in the     Windows System Information Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to open a     specially crafted file, to disclose arbitrary files via     an XML external entity (XXE) declaration.
    (CVE-2017-8557)

  - An elevation of privilege vulnerability exists in the     Windows kernel due to improper handling of objects in     memory. A local attacker can exploit this, via a     specially crafted application, to execute arbitrary code     with elevated permissions. (CVE-2017-8561)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of calls to Advanced     Local Procedure Call (ALPC). An authenticated, remote     attacker can exploit this via a specially crafted     application, to run processes in an elevated context.
    (CVE-2017-8562)

  - An elevation of privilege vulnerability exists in     Windows due to Kerberos falling back to NT LAN Manager     (NTLM) Authentication Protocol as the default     authentication protocol. An authenticated, remote     attacker can exploit this, via an application that     sends specially crafted traffic to a domain controller,     to run processes in an elevated context.
    (CVE-2017-8563)*

  - An information disclosure vulnerability exists in the     Windows kernel due to improper initialization of objects     in memory. An authenticated, remote attacker can exploit     this, via a specially crafted application, to bypass     Kernel Address Space Layout Randomization (KASLR) and     disclose the base address of the kernel driver.
    (CVE-2017-8564)

  - A remote code execution vulnerability exists in     PowerShell when handling a PSObject that wraps a CIM     instance. An authenticated, remote attacker can exploit     this, via a specially crafted script, to execute     arbitrary code in a PowerShell remote session.
    (CVE-2017-8565)

  - An elevation of privilege vulnerability exists in     Windows Input Method Editor (IME) due to improper     handling of parameters in a method of a DCOM class. A     local attacker can exploit this, via a specially crafted     application, to run processes in an elevated context.
    (CVE-2017-8566)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of objects in memory. A     local attacker can exploit this, via a specially crafted     application, to run arbitrary code in kernel mode.
    (CVE-2017-8581)

  - An information disclosure vulnerability exists in the     HTTP.sys server application component due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to disclose sensitive information.
    (CVE-2017-8582)

  - A remote code execution vulnerability exists in     Microsoft HoloLens due to improper handling of objects     in memory. An unauthenticated, remote attacker can     exploit this, via a specially crafted packet, to execute     arbitrary code. (CVE-2017-8584)

  - A denial of service vulnerability exists in the     Microsoft Common Runtime Library component due to     improper handling of web requests. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to cause a denial of service condition     in a .NET application. (CVE-2017-8585)

  - A remote code execution vulnerability exists in WordPad     due to improper parsing of specially crafted files. An     unauthenticated, remote attacker can exploit this, by     convincing a user to open a specially crafted file, to     execute arbitrary code in the context of the current     user. (CVE-2017-8588)

  - A remote code execution vulnerability exists in the     Windows Search component due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by sending specially crafted messages     to the Windows Search service, to elevate privileges and     execute arbitrary code. (CVE-2017-8589)

  - An elevation of privilege vulnerability exists in the     Windows Common Log File System (CLFS) driver due to     improper handling of objects in memory. A local attacker     can exploit this, via a specially crafted application,     to run processes in an elevated context. (CVE-2017-8590)

  - A security bypass vulnerability exists in Microsoft     browsers due to improper handling of redirect requests.
    An unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to bypass CORS redirect restrictions. (CVE-2017-8592)

  - Multiple remote code execution vulnerability exist in     Microsoft Edge in the scripting engine due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit these, by convincing a user     to visit a specially crafted website, to execute     arbitrary code in the context of the current user.
    (CVE-2017-8595, CVE-2017-8598, CVE-2017-8603,     CVE-2017-8604, CVE-2017-8605, CVE-2017-8619)

  - A remote code execution vulnerability exists in     Microsoft Edge due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     website, to execute arbitrary code in the context of the     current user. (CVE-2017-8596)

  - A security bypass vulnerability exists in Microsoft Edge     due to a failure to correctly apply the same-origin     policy for HTML elements present in other browser     windows. An unauthenticated, remote attacker can exploit     this, by convincing a user to follow a link, to cause     the user to load a malicious website. (CVE-2017-8599)

  - A remote code execution vulnerability exists in     Microsoft Edge in the Chakra JavaScript engine due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8601)

  - A spoofing vulnerability exists in Microsoft browsers     due to improper parsing of HTTP content. An     unauthenticated, remote attacker can exploit this, by     convincing a user to click a specially crafted URL, to     redirect the user to a malicious website.
    (CVE-2017-8602)

  - Multiple remote code execution vulnerabilities exist in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8606, CVE-2017-8607, CVE-2017-8608)

  - A remote code execution vulnerability exists in     Microsoft browsers in the scripting engine due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8609)

  - A spoofing vulnerability exists in Microsoft Edge due to     improper parsing of HTTP content. An unauthenticated,     remote attacker can exploit this, by convincing a user     to click a specially crafted URL, to redirect the user     to a malicious website. (CVE-2017-8611)

  - A remote code execution vulnerability exists in Internet     Explorer in the VBScript engine due to improper handling     of objects in memory. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a specially crafted website, to execute arbitrary code     in the context of the current user. (CVE-2017-8618)

    * note CVE-2017-8563 introduces a registry setting that     administrators can use to help make LDAP authentication     over SSL/TLS more secure, administrators need to create     a LdapEnforceChannelBinding registry setting on machine     running AD DS or AD LDS.

Detections

Analytics

Plugins Search

critical