| Description: | Summary:
This host is missing a critical security
update according to Microsoft KB4512506.
Vulnerability Insight:
Multiple flaws exist as,
- Microsoft Hyper-V Network Switch on a host server fails to properly validate
input from a privileged user on a guest operating system.
- Windows improperly handles objects in memory.
- VBScript engine improperly handles objects in memory.
- The XmlLite runtime (XmlLite.dll) improperly parses XML input.
- Microsoft browsers improperly handle requests of different origins.
- Windows Server DHCP service improperly process specially crafted packets.
- Bluetooth BR/EDR key negotiation vulnerability that exists at the hardware
specification level of any BR/EDR Bluetooth device.
Please see the references for more information about the vulnerabilities.
Vulnerability Impact:
Successful exploitation will allow
an attacker to crash the host server, execute arbitrary code on the target
system, obtain information that could be used to try to further compromise
the affected system and negotiate the offered key length of bluetooth
connection.
Affected Software/OS:
- Microsoft Windows 7 for 32-bit/x64 Systems Service Pack 1
- Microsoft Windows Server 2008 R2 for x64-based Systems Service Pack 1
Solution:
The vendor has released updates. Please see
the references for more information.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
