• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – Microsoft Windows 8.1 Multiple Vulnerabilities
November 19, 2018
Rewterz Threat Advisory – CVE-2018-17479 – Google Chrome USE-AFTER-FREE vulnerability
November 20, 2018

Rewterz Threat Advisory – Microsoft Windows Server 2012, multiple vulnerabilities

November 19, 2018

New updates are available for Microsoft Windows Server 2012 for multiple vulnerabilities, now inclusive of a patch for CVE identifier CVE-2017-5715.

 

 

IMPACT:  NORMAL

 

 

PUBLISH DATE:  11-19-2018

 

 

OVERVIEW

 

 

Multiple vulnerabilities have been reported in Microsoft Windows Server 2012, which can be exploited by malicious, local users to gain escalated privileges, bypass certain security restrictions and cause a DoS (Denial of Service). Updates are available.

 

 

ANALYSIS

 

 

A number of CVE references are associated with the updates.

 

  • CVE-2017-5754
  • CVE-2017-5715
  • CVE-2017-5753

Systems with microprocessors that utilize speculative execution and indirect branch prediction may allow local users to access unauthorized information using side-channel analysis of the data cache.

 

  • CVE-2018-0744

This vulnerability allows a privilege escalation due to the way objects are handled in memory, aka “Windows Elevation of Privilege Vulnerability”.

 

  • CVE-2018-0788

The Windows Adobe Type Manager Font Driver (Atmfd.dll) allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka “OpenType Font Driver Elevation of Privilege Vulnerability”.

 

  • CVE-2018-0748

The Windows kernel in multiple versions of multiple products allows an elevation of privilege vulnerability due to the way memory addresses are handled, aka “Windows Elevation of Privilege Vulnerability”.

 

  • CVE-2018-0751

The Windows Kernel API allows an elevation of privilege vulnerability due to the way the Kernel API enforces permissions, aka “Windows Elevation of Privilege Vulnerability”.

 

  • CVE-2018-0754

The Windows Adobe Type Manager Font Driver (Atmfd.dll) allows an information disclosure vulnerability due to the way objects are handled in memory, aka “OpenType Font Driver Information Disclosure Vulnerability”.

 

  • CVE-2018-0747

The Windows kernel allows an information disclosure vulnerability due to the way memory addresses are handled.

 

  • CVE-2018-0753

A denial of service vulnerability exists due to the way objects are handled in memory, aka “Windows IPSec Denial of Service Vulnerability”.

 

  • CVE-2018-0746

An information disclosure vulnerability exists due to the way memory addresses are handled, aka “Windows Information Disclosure Vulnerability”.

 

  • CVE-2018-0752

The Windows Kernel API allows an elevation of privilege vulnerability due to the way the Kernel API enforces permissions, aka “Windows Elevation of Privilege Vulnerability”.

 

  • CVE-2018-0749

The Microsoft Server Message Block (SMB) Server allows an elevation of privilege vulnerability due to the way SMB Server handles specially crafted files, aka “Windows Elevation of Privilege Vulnerability”.

 

 

AFFECTED PRODUCTS

 

 

Microsoft Windows Server 2012

 

 

UPDATES

 

 

Update the following versions as suggested:

  • Windows Server 2012 (KB4338830) Monthly Rollup:
  • Windows Server 2012 (Server Core installation) (KB4338830) Monthly Rollup:

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4338830

 

  • Windows Server 2012 R2 (KB4338815) Monthly Rollup:
  • Windows Server 2012 R2 (Server Core installation) (KB4338815) Monthly Rollup:

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4338815

 

  • Windows Server 2012 (KB4338820):
  • Windows Server 2012 (Server Core installation) (KB4338820):

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4338820

 

  • Windows Server 2012 R2 (KB4338824):
  • Windows Server 2012 R2 (Server Core installation) (KB4338824):

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4338824

 

  • Windows Server 2012 (KB4088877) Monthly Rollup
  • Windows Server 2012 (Server Core installation) (KB4088877) Monthly Rollup:

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4088877

 

  • Windows Server 2012 (KB4088880) Security Only
  • Windows Server 2012 (Server Core installation) (KB4088880) Security Only:

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4088880

 

  • Windows Server 2012 R2 (KB4056895) Monthly Rollup
  • Windows Server 2012 R2 (Server Core installation) (KB4056895) Monthly Rollup:

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4056895

 

  • Windows Server 2012 (KB4056896) Monthly Rollup:
  • Windows Server 2012 (Server Core installation) (KB4056896) Monthly Rollup:

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4056896

 

  • Windows Server 2012 (KB4056899) Security Only:
  • Windows Server 2012 (Server Core installation) (KB4056899) Security Only:

https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4056899

 

  • Windows Server 2012 R2 (KB4056898):
  • Windows Server 2012 R2 (Server Core installation) (KB4056898):

https://support.microsoft.com/help/4056898

 

  • Windows Server 2012 R2 Standard (KB4078130):

https://www.catalog.update.microsoft.com/Search.aspx?q=KB4078130

 

It is recommended to update the products you’re using, if any, as soon as possible.

 

If you think you’re the victim of a cyber-attack, immediately send an email to soc@rewterz.com.

  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.