Microsoft security alert.

May 8, 2018

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 69 vulnerabilities that were fixed in 7 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 7 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

  • Microsoft Windows Security Update May 2018

    Severity
    Urgent 5
    Qualys ID
    91447
    Vendor Reference
    KB4093107, KB4093112, KB4093119, KB4094079, KB4101477, KB4103712, KB4103715, KB4103716, KB4103718, KB4103721, KB4103723, KB4103725, KB4103726, KB4103727, KB4103730, KB4103731, KB4130944, KB4130956, KB4131188, KB4134651
    CVE Reference
    CVE-2018-0824, CVE-2018-0854, CVE-2018-0958, CVE-2018-0959, CVE-2018-0961, CVE-2018-0963, CVE-2018-1035, CVE-2018-8120, CVE-2018-8124, CVE-2018-8127, CVE-2018-8129, CVE-2018-8132, CVE-2018-8134, CVE-2018-8136, CVE-2018-8141, CVE-2018-8142, CVE-2018-8164, CVE-2018-8165, CVE-2018-8166, CVE-2018-8167, CVE-2018-8170, CVE-2018-8174, CVE-2018-8897
    CVSS Scores
    Base 9.3 / Temporal 8.1
    Description
    Microsoft has released Cumulative Security Updates for Windows which addresses the following vulnerabilities:

    A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects. (CVE-2018-0824)
    A security feature bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard. (CVE-2018-0854)
    A remote code execution vulnerability exists in the way that Windows handles objects in memory. (CVE-2018-8136)
    A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard. (CVE-2018-0958)
    A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2018-0959,CVE-2018-0961)
    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. (CVE-2018-8124)
    A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard. (CVE-2018-8129, CVE-2018-8132)
    An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. (CVE-2018-8134)
    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. (CVE-2018-8164)
    An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL)
    driver improperly handles objects in memory. (CVE-2018-8165)
    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. (CVE-2018-8166)
    An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS)
    driver improperly handles objects in memory. (CVE-2018-8167)
    An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. (CVE-2018-8897, CVE-2018-8127,CVE-2018-8141, CVE-2018-8170,CVE-2018-8142)
    A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard. (CVE-2018-1035)

    The following are actively exploited in the wild

    CVE 2018-8174, a remote code execution vulnerability in the VBScript Engine.
    CVE 2018:8120, a privilege escalation vulnerability in Win32k.

    Note: CVE-2018-0963 has been addressed for Windows 10 1709 only in May Updates.

    QID Detection Logic (Authenticated):
    Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for following file versions %windir%\System32\Win32k.sys for all affected OS except Windows 10 and Windows 16:
    The patch version of 6.0.6002.24344 (KB4131188)
    The patch version of 6.1.7601.24093 (KB4103712 or KB4103718)
    The patch version of 6.2.9200.22413 (KB4103726 or KB4103730)
    The patch version of 6.3.9600.18979 (KB4103725 or KB4103715)

    This QID checks for following file versions %windir%\System32\Win32kfull.sys for Windows 10 and Windows 16:
    The patch version of 10.0.10240.17861 (KB4103716)
    The patch version of 10.0.14393.2248 (KB4103723)
    The patch version of 10.0.15063.1088 (KB4103731 )
    The patch version of 10.0.16299.431 (KB4103727)
    The patch version of 10.0.17134.48 (KB4103721)

    This QID checks for following files and its versions for Windows 2008 SP2:
    The patch version of %windir%\System32\Clfs.sys 6.0.6002.24361 (KB4130944)
    The patch version of %windir%\System32\drivers\Vmms.exe 6.0.6002.24362 (KB4094079)
    The patch version of %windir%\system32\Advapi32.dll 6.0.6002.24367 (KB4134651)
    The patch version of %windir%\System32\Comsvcs.dll 2001.12.6932.24363 (KB4101477)
    The patch version of %windir%\System32\Hhsetup.dll 6.0.6002.24396 (KB4130956)

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4093107
    KB4093112
    KB4093119
    KB4094079
    KB4101477
    KB4103712
    KB4103715
    KB4103716
    KB4103718
    KB4103721
    KB4103723
    KB4103725
    KB4103726
    KB4103727
    KB4103730
    KB4103731
    KB4130944
    KB4130956
    KB4131188

  • Microsoft Internet Explorer Security Update for May 2018

    Severity
    Critical 4
    Qualys ID
    100335
    Vendor Reference
    KB4103716, KB4103718, KB4103721, KB4103723, KB4103725, KB4103727, KB4103730, KB4103731, KB4103768
    CVE Reference
    CVE-2018-0954, CVE-2018-0955, CVE-2018-1022, CVE-2018-1025, CVE-2018-8114, CVE-2018-8122, CVE-2018-8126, CVE-2018-8145, CVE-2018-8178
    CVSS Scores
    Base 7.6 / Temporal 6
    Description
    Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

    Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The security updated is rated Moderate for for Internet Explorer 9 (IE 9) and Internet Explorer 10 (IE 10) and Critical for Internet Explorer 11 (IE 11). The most severe of the vulnerabilities could allow remote code execution.

    KB Articles associated with the Update:
    1) 4103718
    2) 4103768
    3) 4103725
    4) 4103723
    5) 4103716
    6) 4103731
    7) 4103727
    8) 4103721
    9) 4103730

    QID Detection Logic (Authenticated):
    Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for the file version of %windir%\System32\mshtml.dll
    The following KBs are checked:
    The patch version is 11.0.9600.18978 (KB4103718 or KB4103725 or KB4103768)
    The patch version is 11.0.10240.17861 (KB4103716)
    The patch version is 11.0.14393.2248 (KB4103723)
    The patch version is 11.0.15063.1088 (KB4103731)
    The patch version is 11.0.16299.431 (KB4103727)
    The patch version is 11.0.17134.48(KB4103727)
    The patch version is 10.0.9200.22435 (KB4103730 or KB4103768)
    The patch version is 9.0.8112.21219 (KB4103768)

    Consequence
    Successful exploitation of the vulnerability will lead to:

    1) Remote Code Execution
    2) Information Disclosure
    3) Security Feature Bypass

    Solution
    For more information, Customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft Edge Security Update for May 2018

    Severity
    Critical 4
    Qualys ID
    91448
    Vendor Reference
    KB4103716, KB4103721, KB4103723, KB4103727, KB4103731
    CVE Reference
    CVE-2018-0943, CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0993, CVE-2018-1021, CVE-2018-1022, CVE-2018-1025, CVE-2018-8112, CVE-2018-8123, CVE-2018-8128, CVE-2018-8130, CVE-2018-8133, CVE-2018-8137, CVE-2018-8139, CVE-2018-8145, CVE-2018-8178, CVE-2018-8179
    CVSS Scores
    Base 7.6 / Temporal 6.3
    Description
    Microsoft Edge is a web browser developed by Microsoft that replaces Internet Explorer as the default web browser.
    Microsoft Edge suffers multiple security vulnerabilities. The most severe of the vulnerabilities could allow remote code execution.

    KB Articles associated with the update:
    1) KB4103723
    2) KB4103716
    3) KB4103731
    4) KB4103727
    5) KB4103721

    Note: CVE-2018-0993 has been addressed for Windows 10 1507 only in May Updates. For remaining Windows versions please refer to April 2018 updates

    QID Detection Logic (Authenticated):
    Operating Systems: Windows 10 (1507, 1607, 1703, 1709 and 1803) and Windows Server 2016
    This QID checks for the file version of %windir%\System32\edgehtml.dll
    The following KBs are checked:
    The patch version is 11.0.10240.17861 (KB4103716)
    The patch version is 11.0.14393.2248 (KB4103723)
    The patch version is 11.0.15063.1088 (KB4103731)
    The patch version is 11.0.16299.431 (KB4103727)
    The patch version is 11.0.17134.48(KB4103727)

    Consequence
    Successful exploitation of the vulnerability allows:

    1) Remote Code Execution
    2) Information Disclosure
    2) Security Feature Bypass

    Solution
    For more information, customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft .NET Framework Security Update May 2018

    Severity
    Critical 4
    Qualys ID
    91449
    Vendor Reference
    4095512, 4095513, 4095514, 4095515, 4095517, 4095518, 4095519, 4095872, 4095873, 4095874, 4095875, 4095876, 4096235, 4096236, 4096237, 4096416, 4096417, 4096418, 4096494, 4096495, 4103716, 4103721, 4103723, 4103727, 4103731
    CVE Reference
    CVE-2018-0765, CVE-2018-1039
    CVSS Scores
    Base 5 / Temporal 3.7
    Description
    A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. (CVE-2018-1039)

    A Denial of Service vulnerability exists when .NET, and .NET core, improperly process XML documents. (CVE-2018-0765)

    KB4095512,KB4095513,KB4095514,KB4095515,KB4095517,KB4095518,KB4095519,KB4095872,KB4095873,KB4095874,KB4095875,KB4095876,KB4096235,KB4096236,KB4096237,KB4096416,KB4096417,KB4096418,KB4096494,KB4096495,KB4103716,KB4103721,KB4103723,KB4103727,KB4103731 are covered in this QID

    This security update is rated Important for supported versions of Microsoft .NET Framework.

    QID Detection Logic (Authenticated):
    This QID checks for the vulnerable file version of system.security.dll

    Consequence
    Successful exploitation allows an attacker to cause denial of service and bypass the security features.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    .NET Framework May 2018

  • Microsoft Windows Adobe Flash Player Security Update for May 2018 (ADV180008)

    Severity
    Urgent 5
    Qualys ID
    100336
    Vendor Reference
    ADV180008
    CVE Reference
    CVE-2018-4944
    CVSS Scores
    Base 10 / Temporal 7.4
    Description
    This security update resolves vulnerabilities which are described in the Adobe Security Bulletin APSB18-16, if installed on any supported edition of Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows 10 Version 1703, Windows 10 Version 1709, Windows 8.1, or Windows RT 8.1.

    QID Detection Logic:
    Operating Systems: Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This authenticated QID checks for the file version of %windir%\System32\Macromed\Flash\Flash.ocx for file versions lesser than 29.0.0.171.

    KB Articles associated with this update are: ADV180008

    Consequence
    Successful exploitation allows an attacker to execute code remotely and bypass security restrictions to gain access to sensitive information.
    Solution
    Customers are advised to follow KB4103729 for instructions pertaining to the remediation of these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4103729

  • Microsoft Office and Microsoft Office Services and Web Apps Security Update May 2018

    Severity
    Critical 4
    Qualys ID
    110317
    Vendor Reference
    KB2899590, KB3114889, KB3162075, KB3172436, KB4018308, KB4018327, KB4018381, KB4018382, KB4018383, KB4018388, KB4018390, KB4018393, KB4018396, KB4018398, KB4018399, KB4022130, KB4022135, KB4022137, KB4022139, KB4022141, KB4022142, KB4022145, KB4022146, KB4022150
    CVE Reference
    CVE-2018-8147, CVE-2018-8148, CVE-2018-8149, CVE-2018-8150, CVE-2018-8155, CVE-2018-8156, CVE-2018-8157, CVE-2018-8158, CVE-2018-8160, CVE-2018-8161, CVE-2018-8162, CVE-2018-8163, CVE-2018-8168, CVE-2018-8173
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    Microsoft releases security updates on May 2018 to fix multiple security vulnerabilities:

    This security updates contain following KBs:
    KB2899590 KB3114889 KB3162075 KB3172436 KB4018308 KB4018327 KB4018381 KB4018382 KB4018383 KB4018388 KB4018390 KB4018393 KB4018396 KB4018398 KB4018399 KB4022130 KB4022135 KB4022137 KB4022139 KB4022141 KB4022142 KB4022145 KB4022146 KB4022150 QID Detection Logic:
    This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

    Consequence
    An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Office and Microsoft Office Services and Web Apps Security Update May 2018(Office)

  • Microsoft Windows Exchange Server Update For May 2018

    Severity
    Critical 4
    Qualys ID
    53014
    Vendor Reference
    KB4091243, KB4092041
    CVE Reference
    CVE-2018-8151, CVE-2018-8152, CVE-2018-8153, CVE-2018-8154, CVE-2018-8159
    CVSS Scores
    Base 10 / Temporal 7.4
    Description
    This security update resolves a vulnerability in Microsoft Exchange Outlook Web Access (OWA). The vulnerability could allow elevation of privilege or spoofing in Microsoft Exchange Server if an attacker sends an email message that has a specially crafted attachment to a vulnerable server that is running Exchange Server.

    KB Articles associated with this update are: KB4092041, KB4091243

    Affected Versions:
    Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 21
    Microsoft Exchange Server 2013 Service Pack 1
    Microsoft Exchange Server 2013 Cumulative Update 19
    Microsoft Exchange Server 2016 Cumulative Update 8
    Microsoft Exchange Server 2016 Cumulative Update 9
    Microsoft Exchange Server 2013 Cumulative Update 20

    QID Detection Logic:
    File versions of bin\Exsetup.exe file are checked:
    MS Exchange 2010: 14.3.399.2
    MS Exchange 2013 - SP1: 15.0.847.62
    MS Exchange 2013 - CU19 and CU20: 15.0.1365.7
    MS Exchange 2016 - CU8 and CU9: 15.1.1415.7, 15.1.1466.8

    Consequence
    Successful exploitation of the vulnerability will lead to privilege escalation or spoofing in Microsoft Exchange Server if an attacker sends an email that has a specially crafted attachment to a vulnerable Exchange server.

    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4091243
    KB4092041

These new vulnerability checks are included in Qualys vulnerability signature 2.4.325-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 91447
    • 100335
    • 91448
    • 91449
    • 100336
    • 110317
    • 53014
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.