Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
New updates are available for Microsoft Windows Server 2012 for multiple vulnerabilities, now inclusive of a patch for CVE identifier CVE-2017-5715.
IMPACT: NORMAL
PUBLISH DATE: 11-19-2018
OVERVIEW
Multiple vulnerabilities have been reported in Microsoft Windows Server 2012, which can be exploited by malicious, local users to gain escalated privileges, bypass certain security restrictions and cause a DoS (Denial of Service). Updates are available.
ANALYSIS
A number of CVE references are associated with the updates.
Systems with microprocessors that utilize speculative execution and indirect branch prediction may allow local users to access unauthorized information using side-channel analysis of the data cache.
This vulnerability allows a privilege escalation due to the way objects are handled in memory, aka “Windows Elevation of Privilege Vulnerability”.
The Windows Adobe Type Manager Font Driver (Atmfd.dll) allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka “OpenType Font Driver Elevation of Privilege Vulnerability”.
The Windows kernel in multiple versions of multiple products allows an elevation of privilege vulnerability due to the way memory addresses are handled, aka “Windows Elevation of Privilege Vulnerability”.
The Windows Kernel API allows an elevation of privilege vulnerability due to the way the Kernel API enforces permissions, aka “Windows Elevation of Privilege Vulnerability”.
The Windows Adobe Type Manager Font Driver (Atmfd.dll) allows an information disclosure vulnerability due to the way objects are handled in memory, aka “OpenType Font Driver Information Disclosure Vulnerability”.
The Windows kernel allows an information disclosure vulnerability due to the way memory addresses are handled.
A denial of service vulnerability exists due to the way objects are handled in memory, aka “Windows IPSec Denial of Service Vulnerability”.
An information disclosure vulnerability exists due to the way memory addresses are handled, aka “Windows Information Disclosure Vulnerability”.
The Windows Kernel API allows an elevation of privilege vulnerability due to the way the Kernel API enforces permissions, aka “Windows Elevation of Privilege Vulnerability”.
The Microsoft Server Message Block (SMB) Server allows an elevation of privilege vulnerability due to the way SMB Server handles specially crafted files, aka “Windows Elevation of Privilege Vulnerability”.
AFFECTED PRODUCTS
Microsoft Windows Server 2012
UPDATES
Update the following versions as suggested:
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4338830
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4338815
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4338820
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4338824
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4088877
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4088880
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4056895
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4056896
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4056899
https://support.microsoft.com/help/4056898
https://www.catalog.update.microsoft.com/Search.aspx?q=KB4078130
It is recommended to update the products you’re using, if any, as soon as possible.
If you think you’re the victim of a cyber-attack, immediately send an email to soc@rewterz.com.