CVE-2018-8304
published 2018-07-11CVE-2018-8304: A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, aka "Windows DNSAPI…
PriorityP333medium5.9CVSS 3.0
AVNACHPRNUINSUCNINAH
EPSS
11.80%
95.6th percentile
A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, aka "Windows DNSAPI Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Affected
45 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_servers | — | — |
| microsoft | windows_7 | — | — |
| microsoft | windows_7 | — | — |
| microsoft | windows_8.1 | — | — |
| microsoft | windows_8.1 | — | — |
| microsoft | windows_rt_8.1 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2 | — | — |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
vendor_msrc5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h39p-f222-x6p2: A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI
ghsa_unreviewed·2022-05-13
CVE-2018-8304 [HIGH] GHSA-h39p-f222-x6p2: A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI
A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, aka "Windows DNSAPI Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Microsoft
Windows DNSAPI Denial of Service Vulnerability
vendor_msrc·2018-07-10·CVSS 5.9
CVE-2018-8304 [MEDIUM] Windows DNSAPI Denial of Service Vulnerability
Windows DNSAPI Denial of Service Vulnerability
Description: A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses. An attacker who successfully exploited the vulnerability could cause a system to stop responding. Note that the denial of service condition would not allow an attacker to execute code or to elevate user privileges. However, the denial of service condition could prevent authorized users from using system resources.
To exploit the vulnerability, the attacker would use a malicious DNS server to send corrupted DNS responses to the target.
The update addresses the vulnerability by modifying how Windows DNSAPI.dll handles DNS responses.
Microsoft Windows DNS: Microsoft Windows DNS
Impact: Denial of S
No detection rules found.
No public exploits indexed.
Trendmicro
July Patch Tuesday: Large Adobe Security Update
blogs_trendmicro·2018-07-11·CVSS 5.3
CVE-2018-8280 [MEDIUM] July Patch Tuesday: Large Adobe Security Update
Exploits & Vulnerabilities
## July Patch Tuesday: Large Adobe Security Update
Patch Tuesday for July addresses 53 Microsoft and 107 Adobe vulnerabilities.
By: Trend Micro 2018/07/11 Read time: ( words)
Save to Folio
July’s Patch Tuesday addresses 53 vulnerabilities, including 18 critical ones, most of which involve Microsoft’s browsers. These include CVE-2018-8280 , CVE-2018-8286 , CVE-2018-8290 , CVE-2018-8294 , and CVE-2018-8298 , all of which are corruption bugs in the Chakra Javascript Engine that exist in the way it handles objects in memory in Microsoft Edge. An attacker could then use a specially crafted website that could potentially provide administrative rights to the perpetrator.
CVE-2018-8304 , a Windows DNSAPI Denial of Service Vulnerability, is another noteworthy vulner
Trendmicro
July Patch Tuesday: Large Adobe Security Update
blogs_trendmicro·2018-07-11·CVSS 5.3
CVE-2018-8280 [MEDIUM] July Patch Tuesday: Large Adobe Security Update
Exploits y vulnerabilidades
## July Patch Tuesday: Large Adobe Security Update
Patch Tuesday for July addresses 53 Microsoft and 107 Adobe vulnerabilities.
By: Trend Micro Jul 11, 2018 Read time: ( words)
Save to Folio
July’s Patch Tuesday addresses 53 vulnerabilities, including 18 critical ones, most of which involve Microsoft’s browsers. These include CVE-2018-8280 , CVE-2018-8286 , CVE-2018-8290 , CVE-2018-8294 , and CVE-2018-8298 , all of which are corruption bugs in the Chakra Javascript Engine that exist in the way it handles objects in memory in Microsoft Edge. An attacker could then use a specially crafted website that could potentially provide administrative rights to the perpetrator.
CVE-2018-8304 , a Windows DNSAPI Denial of Service Vulnerability, is another noteworthy vul
Trendmicro
July Patch Tuesday: Large Adobe Security Update
blogs_trendmicro·2018-07-11·CVSS 5.3
CVE-2018-8280 [MEDIUM] July Patch Tuesday: Large Adobe Security Update
Exploits & Vulnerabilities
## July Patch Tuesday: Large Adobe Security Update
Patch Tuesday for July addresses 53 Microsoft and 107 Adobe vulnerabilities.
By: Trend Micro Jul 11, 2018 Read time: ( words)
Save to Folio
July’s Patch Tuesday addresses 53 vulnerabilities, including 18 critical ones, most of which involve Microsoft’s browsers. These include CVE-2018-8280 , CVE-2018-8286 , CVE-2018-8290 , CVE-2018-8294 , and CVE-2018-8298 , all of which are corruption bugs in the Chakra Javascript Engine that exist in the way it handles objects in memory in Microsoft Edge. An attacker could then use a specially crafted website that could potentially provide administrative rights to the perpetrator.
CVE-2018-8304 , a Windows DNSAPI Denial of Service Vulnerability, is another noteworthy vuln
Trendmicro
July Patch Tuesday: Large Adobe Security Update
blogs_trendmicro·2018-07-11·CVSS 5.3
CVE-2018-8280 [MEDIUM] July Patch Tuesday: Large Adobe Security Update
Ausnutzung von Schwachstellen
## July Patch Tuesday: Large Adobe Security Update
Patch Tuesday for July addresses 53 Microsoft and 107 Adobe vulnerabilities.
By: Trend Micro Jul 11, 2018 Read time: ( words)
Save to Folio
July’s Patch Tuesday addresses 53 vulnerabilities, including 18 critical ones, most of which involve Microsoft’s browsers. These include CVE-2018-8280 , CVE-2018-8286 , CVE-2018-8290 , CVE-2018-8294 , and CVE-2018-8298 , all of which are corruption bugs in the Chakra Javascript Engine that exist in the way it handles objects in memory in Microsoft Edge. An attacker could then use a specially crafted website that could potentially provide administrative rights to the perpetrator.
CVE-2018-8304 , a Windows DNSAPI Denial of Service Vulnerability, is another noteworthy v
Trendmicro
July Patch Tuesday: Large Adobe Security Update
blogs_trendmicro·2018-07-11·CVSS 5.3
CVE-2018-8280 [MEDIUM] July Patch Tuesday: Large Adobe Security Update
Exploits & Vulnerabilities
# July Patch Tuesday: Large Adobe Security Update
Patch Tuesday for July addresses 53 Microsoft and 107 Adobe vulnerabilities.
By: Trend Micro
2018/07/11
Read time: ( words)
Save to Folio
July’s Patch Tuesday addresses 53 vulnerabilities, including 18 critical ones, most of which involve Microsoft’s browsers. These include CVE-2018-8280, CVE-2018-8286, CVE-2018-8290, CVE-2018-8294, and CVE-2018-8298, all of which are corruption bugs in the Chakra Javascript Engine that exist in the way it handles objects in memory in Microsoft Edge. An attacker could then use a specially crafted website that could potentially provide administrative rights to the perpetrator.
CVE-2018-8304, a Windows DNSAPI Denial of Service Vulnerability, is another noteworthy vulnerabilit
Talos
Microsoft Patch Tuesday - July 2018
blogs_talos·2018-07-10·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - July 2018
Microsoft released its monthly set of security advisories today for vulnerabilities that have been identified and addressed in various products. This month's release addresses 53 new vulnerabilities, 17 of which are rated critical, 34 are rated important, one is rated moderate, and one is rated as low severity. These vulnerabilities impact Windows Operating System, Edge, Internet Explorer and more.
In addition to the 53 vulnerabilities referenced above, Microsoft has also released a critical update advisory, ADV180017, which addresses the vulnerabilities described in the Adobe security bulletin APSB18-24.
## Critical vulnerabilitiesThis month, Microsoft is addressing 17 vulnerabilities that are rated as critical:
CVE-2018-8242 - Scripting Engine Memory Corruption Vulnerability
CVE-2018-
Talos
Microsoft Patch Tuesday - July 2018
blogs_talos·2018-07-10·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - July 2018
## Microsoft Patch Tuesday - July 2018
Microsoft released its monthly set of security advisories today for vulnerabilities that have been identified and addressed in various products. This month's release addresses 53 new vulnerabilities, 17 of which are rated critical, 34 are rated important, one is rated moderate, and one is rated as low severity. These vulnerabilities impact Windows Operating System, Edge, Internet Explorer and more.
In addition to the 53 vulnerabilities referenced above, Microsoft has also released a critical update advisory, ADV180017 , which addresses the vulnerabilities described in the Adobe security bulletin APSB18-24 .
## Critical vulnerabilities This month, Microsoft is addressing 17 vulnerabilities that are rated as critical:
CVE-2018-8242 - Scripting Engin
http://www.securityfocus.com/bid/104617http://www.securitytracker.com/id/1041262https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8304http://www.securityfocus.com/bid/104617http://www.securitytracker.com/id/1041262https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8304
2018-07-11
Published