| Description: | Summary:
This host is missing a critical security
update according to Microsoft KB4041681
Vulnerability Insight:
Multiple flaws exist due to:
- A spoofing vulnerability in the Windows implementation of wireless networking (KRACK)
- An error in the Microsoft Server Block Message (SMB) when an attacker sends
specially crafted requests to the server.
- An error in the Windows kernel that could allow an attacker to retrieve
information that could lead to a Kernel Address Space Layout Randomization
(ASLR) bypass.
- An error when the Windows kernel improperly handles objects in memory.
- An error when the Windows font library improperly handles specially crafted
embedded fonts.
- An error when the Windows kernel-mode driver fails to properly handle objects
in memory.
- An error when Internet Explorer improperly accesses objects in memory.
- An error in the Microsoft JET Database Engine that could allow remote code
execution on an affected system.
- An error when Internet Explorer improperly handles objects in memory.
- An error when the Windows Graphics Component improperly handles objects in
memory.
- An error in the way that the scripting engine handles objects in memory in
Internet Explorer.
- An error when Internet Explorer improperly accesses objects in memory via the
Microsoft Windows Text Services Framework.
- An error when Windows Search improperly handles objects in memory.
- An error in the way that Microsoft browsers access objects in memory.
- An error when the Windows kernel improperly initializes objects in memory.
- An error in the way that the Windows Graphics Device Interface (GDI) handles
objects in memory, allowing an attacker to retrieve information from a targeted
system.
- An error in the way that the Windows SMB Server handles certain requests.
Vulnerability Impact:
Successful exploitation will allow an attacker
to execute arbitrary code, conduct denial-of-service, gain access to potentially
sensitive information, take control of the affected system and gain escalated
privileges.
Affected Software/OS:
- Microsoft Windows 7 for 32-bit/x64 Systems Service Pack 1
- Microsoft Windows Server 2008 R2 for x64-based Systems Service Pack 1
Solution:
The vendor has released updates. Please see the references for more information.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
