| Description: | Summary:
This host is missing a critical security
update according to Microsoft KB4284819
Vulnerability Insight:
Multiple flaws exist due to errors,
- When the Windows kernel improperly handles objects in memory.
- When Windows improperly handles objects in memory.
- When the (Human Interface Device) HID Parser Library driver improperly handles
objects in memory.
- In Device Guard that could allow an attacker to inject malicious code into a
Windows PowerShell session.
- In Windows when Desktop Bridge does not properly manage the virtual registry.
- When Windows allows a normal user to access the Wireless LAN profile of an
administrative user.
- When Cortana retrieves data from user input services without consideration for
status.
- When the Windows kernel improperly initializes objects in memory.
- In the way that the Windows Code Integrity Module performs hashing.
- When Microsoft Edge improperly handles requests of different origins.
- In the way that the Windows Kernel API enforces permissions.
- When Microsoft Edge improperly handles objects in memory.
- When Microsoft Edge improperly accesses objects in memory.
- When Windows Media Foundation improperly handles objects in memory.
- When HTTP Protocol Stack (Http.
- When the Windows GDI component improperly discloses the contents of its
memory.
- When Windows Hyper-V instruction emulation fails to properly enforce privilege
levels.
- When Windows NT WEBDAV Minirdr attempts to query a WEBDAV directory.
- When Microsoft Hyper-V Network Switch on a host server fails to properly
validate input from a privileged user on a guest operating system.
- In Internet Explorer that allows for bypassing Mark of the Web Tagging (MOTW).
- When Internet Explorer improperly accesses objects in memory.
- When NTFS improperly checks access.
- When Edge improperly marks files.
- In the way that the Chakra scripting engine handles objects in memory in
Microsoft Edge.
- In the way that the scripting engine handles objects in memory in Internet
Explorer.
- In Windows Domain Name System (DNS) DNSAPI.
Vulnerability Impact:
Successful exploitation will allow an attacker
to obtain information to further compromise the user's system, run processes in
an elevated context, inject code into a trusted PowerShell process, execute
arbitrary code, read privileged data, force the browser to send restricted data,
interject cross-process communication, install programs, view, change, or delete
data or create new accounts with full user rights and create a denial of service
condition.
Affected Software/OS:
Microsoft Windows 10 Version 1709 for x32/x64-bit Systems.
Solution:
The vendor has released updates. Please see the references for more information.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
