Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Multiple vulnerabilities have been reported in Microsoft Windows Server 2012, Microsoft Windows RT 8.1, and Microsoft Windows 8.1. Updates are available that fix these vulnerabilities.
IMPACT: HIGH
PUBLISH DATE: 11-14-2018
OVERVIEW
Multiple vulnerabilities have been reported in Microsoft Windows Server 2012, Microsoft Windows RT 8.1, and Microsoft Windows 8.1, which can be exploited by malicious, local users to disclose sensitive information, bypass certain security restrictions, and gain escalated privileges. Updates are available for fixing these vulnerabilities.
ANALYSIS
An error related to DirectX while handling objects in memory can be exploited to disclose certain data. The successful exploitation of these vulnerabilities may cause significant inconveniences including exposure of sensitive information, script insertion attacks and Security Bypass. Local users with malicious intent may also gain elevated privileges.
A number of CVE references are associated with the updates, whose descriptions are not available at the time of creation of this advisory.
CVE-2018-8256
CVE-2018-8544
CVE-2018-8563
CVE-2018-8549
CVE-2018-8476
CVE-2018-8407
CVE-2018-8562
CVE-2018-8471
CVE-2018-8550
CVE-2018-8485
CVE-2018-8408
CVE-2018-8565
CVE-2018-8553
CVE-2018-8547
CVE-2018-8450
CVE-2018-8561
CVE-2018-8415
AFFECTED PRODUCTS
Microsoft Windows Server 2012
Microsoft Windows RT 8.1
Microsoft Windows 8.1
UPDATES
Update the following versions as suggested:
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4467703
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4467678
Apply update (please see the vendor’s service database for details).
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4467697
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4467697
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4467701
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4467703
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4467703
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB3173426
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB3173424
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB3173424
Note: Security updates for Windows RT 8.1 are available via e.g. Windows Update or Windows Update Catalog only.
It is recommended to update the products you’re using, if any, as soon as possible.
If you think you’re the victim of a cyber-attack, immediately send an email to soc@rewterz.com.