CVE-2018-8611
published 2018-12-12CVE-2018-8611: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege…
PriorityP179high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-06-14
Exploited in the wild
EPSS
4.20%
89.8th percentile
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Affected
52 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_servers | — | — |
| microsoft | windows_10_servers | — | — |
| microsoft | windows_7 | — | — |
| microsoft | windows_7 | — | — |
| microsoft | windows_8.1 | — | — |
| microsoft | windows_8.1 | — | — |
| microsoft | windows_rt_8.1 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2018-8611 exploit targets a race condition in the Kernel Transaction Manager (ntoskrnl.exe). Monitor for suspicious use of NtQueryInformationResourceManager and NtRecoverResourceManager syscalls in rapid succession from the same process, followed by WriteFile on a named pipe — this sequence is the vulnerability trigger. ↗
- →The exploit bypasses Win32k System call Filtering (used in Microsoft Edge Sandbox and Google Chrome Sandbox Win32k Lockdown Policy) because the vulnerable syscalls are in ntoskrnl.exe, not win32k.sys. Sandbox escape detections relying solely on win32k syscall filtering will not catch this exploit. ↗
- →The exploit creates a named pipe and opens it for both read and write as part of its exploitation setup. Combined with KTM object creation and the syscall sequence above, this is a behavioral fingerprint of the CVE-2018-8611 exploit. ↗
- →The exploit heavily relies on C++ exception handling mechanisms with custom error codes, similar to the CHAINSHOT malware. Static analysis of suspicious binaries should look for unusual structured exception handling (SEH) patterns with non-standard error codes. ↗
- →The latest build of the CVE-2018-8611 exploit at time of discovery targeted Windows 10 Redstone 4 Build 17133. Presence of version checks for this specific build in a suspicious binary is an indicator of this exploit family. ↗
- →Kaspersky detected CVE-2018-8611 exploit activity proactively via Behavioral Detection Engine and Automatic Exploit Prevention (AEP). Endpoint products with behavioral/AEP capabilities should be tuned to flag KTM race condition patterns. ↗
- ·Multiple builds of the exploit exist, with the latest at time of discovery targeting Windows 10 RS4 Build 17133. Detection logic may need to account for version-specific offsets and checks across different builds. ↗
- ·The exploit was attributed to at least two threat actors (FruityArmor and SandCat), suggesting it may appear in different malware delivery contexts (FinFisher/FinSpy and CHAINSHOT). Detections should not be scoped to a single threat actor's toolchain. ↗
- ·The NtQuerySystemInformation (class 0x40 / SystemExtendedHandleInformation) kernel address leak technique requires Medium Integrity Level and is considered intended behavior by Microsoft on Windows 10/Server. False-positive risk exists for legitimate software using this API; focus correlation on the full exploit behavioral chain. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
vendor_msrc7.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Windows Kernel Privilege Escalation Vulnerability
cisa·2022-05-24·CVSS 7.8
CVE-2018-8611 [HIGH] CWE-404 Microsoft Windows Kernel Privilege Escalation Vulnerability
Vulnerability: Microsoft Windows Kernel Privilege Escalation Vulnerability
Affected: Microsoft Windows
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-8611
Remediation Due Date: 2022-06-14
Microsoft
Windows Kernel Elevation of Privilege Vulnerability
vendor_msrc·2018-12-11·CVSS 7.0
CVE-2018-8611 [HIGH] Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
Description: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.
The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.
Windows Kernel: Windows Kernel
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:Yes;
GHSA
GHSA-24mr-rp5r-phj8: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Pr
ghsa_unreviewed·2022-05-13
CVE-2018-8611 [HIGH] CWE-404 GHSA-24mr-rp5r-phj8: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Pr
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
VulnCheck
Microsoft Win32k Privilege Escalation Vulnerability
vulncheck·2018·CVSS 7.8
CVE-2018-8453 [HIGH] CWE-404 Microsoft Win32k Privilege Escalation Vulnerability
Microsoft Win32k Privilege Escalation Vulnerability
Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.
Affected: Microsoft Win32k
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-Oct; https://securelist.com/zero-day-in-windows-kernel-transaction-manager-cve-2018-8611/89253/; https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/; https://digital.nhs.uk/cyber-alerts/2019/cc-3044; https://www.cyber.nj.gov/threat-center/threat-profiles/ransomware-variants/sodinokibi; https://web.archive.org/web/20220227045141/https://riskse
VulnCheck
Microsoft Win32k Privilege Escalation Vulnerability
vulncheck·2018·CVSS 7.8
CVE-2018-8589 [HIGH] Microsoft Win32k Privilege Escalation Vulnerability
Microsoft Win32k Privilege Escalation Vulnerability
A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.
Affected: Microsoft Win32k
Required Action: Apply updates per vendor instructions.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-Nov; https://securelist.com/zero-day-in-windows-kernel-transaction-manager-cve-2018-8611/89253/; https://dl.acm.org/doi/pdf/10.1145/3465481.3465758; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-06-13
VulnCheck
Microsoft Windows Kernel Privilege Escalation Vulnerability
vulncheck·2018·CVSS 7.8
CVE-2018-8611 [HIGH] CWE-404 Microsoft Windows Kernel Privilege Escalation Vulnerability
Microsoft Windows Kernel Privilege Escalation Vulnerability
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.
Affected: Microsoft Windows
Required Action: Apply updates per vendor instructions.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-Dec; https://securelist.com/zero-day-in-windows-kernel-transaction-manager-cve-2018-8611/89253/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://thehackernews.com/2023/09/deadglyph-new-advanced-backdoor-with.html
Exploit PoC: https://vulncheck.com/xdb/8342f589a1bd
Remediation Due: 2022-06-14
No detection rules found.
No public exploits indexed.
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022-24521)
blogs_securelist·2023-12-21·CVSS 7.8
[HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022-24521)
Authors
Boris Larin
This is the second part of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous part first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
Part 1 – Windows CLFS and five exploits of ransomware operators
Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
Part 5 – Windows CLFS and five exploits of ransomware operators (Explo
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022-24521)
blogs_securelist·2023-12-21·CVSS 7.8
CVE-2022-24521 [HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022-24521)
Authors
- Boris Larin
This is the second part of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous part first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
- Part 1 – Windows CLFS and five exploits of ransomware operators
- Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
- Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
- Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
- Part 5 – Windows CLFS and five exploits of ransomware operator
Zscaler
CVE-2022-37969 | Windows CLFS Zero-Day - Zscaler Blog
blogs_zscaler·2022-10-28·CVSS 7.8
[HIGH] CVE-2022-37969 | Windows CLFS Zero-Day - Zscaler Blog
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Securelist
New win32k zero day: CVE-2019-0859
blogs_securelist·2019-04-15·CVSS 7.8
CVE-2019-0859 [HIGH] New win32k zero day: CVE-2019-0859
Authors
- Vasily Berdnikov
- Boris Larin
- Anton Ivanov
In March 2019, our automatic Exploit Prevention (EP) systems detected an attempt to exploit a vulnerability in the Microsoft Windows operating system. Further analysis of this event led to us discovering a zero-day vulnerability in win32k.sys. It was the fifth consecutive exploited Local Privilege Escalation vulnerability in Windows that we have discovered in recent months using our technologies. The previous ones were:
- Zero-day exploit (CVE-2018-8453) used in targeted attacks
- A new exploit for zero-day vulnerability CVE-2018-8589
- Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)
- The fourth horseman: CVE-2019-0797 vulnerability
On March 17, 2019 we reported our discovery to Microsoft; the company confirmed the
Securelist
New zero-day vulnerability CVE-2019-0859 in win32k.sys
blogs_securelist·2019-04-15·CVSS 7.8
[HIGH] New zero-day vulnerability CVE-2019-0859 in win32k.sys
Authors
Vasily Berdnikov
Boris Larin
Anton Ivanov
In March 2019, our automatic Exploit Prevention (EP) systems detected an attempt to exploit a vulnerability in the Microsoft Windows operating system. Further analysis of this event led to us discovering a zero-day vulnerability in win32k.sys. It was the fifth consecutive exploited Local Privilege Escalation vulnerability in Windows that we have discovered in recent months using our technologies. The previous ones were:
Zero-day exploit (CVE-2018-8453) used in targeted attacks
A new exploit for zero-day vulnerability CVE-2018-8589
Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)
The fourth horseman: CVE-2019-0797 vulnerability
On March 17, 2019 we reported our discovery to Microsoft; the company confirmed the vulnerab
Securelist
The fourth horseman: CVE-2019-0797 vulnerability | Securelist
blogs_securelist·2019-03-13·CVSS 7.8
CVE-2019-0797 [HIGH] The fourth horseman: CVE-2019-0797 vulnerability | Securelist
Authors
- Vasily Berdnikov
- Boris Larin
## The new zero-day in the Windows OS exploited in targeted attacks
In February 2019, our Automatic Exploit Prevention (AEP) systems detected an attempt to exploit a vulnerability in the Microsoft Windows operating system. Further analysis of this event led to us discovering a zero-day vulnerability in win32k.sys. We reported it to Microsoft on February 22, 2019. The company confirmed the vulnerability and assigned it CVE-2019-0797. Microsoft have just released a patch, crediting Kaspersky Lab researchers Vasiliy Berdnikov and Boris Larin with the discovery:
This is the fourth consecutive exploited Local Privilege Escalation vulnerability in Windows we have discovered recently using our technologies. Just like with CVE-2018-8589, we believe this
Securelist
The fourth horseman: CVE-2019-0797 vulnerability
blogs_securelist·2019-03-13·CVSS 7.8
CVE-2019-0797 [HIGH] The fourth horseman: CVE-2019-0797 vulnerability
Authors
Vasily Berdnikov
Boris Larin
## The new zero-day in the Windows OS exploited in targeted attacks
In February 2019, our Automatic Exploit Prevention (AEP) systems detected an attempt to exploit a vulnerability in the Microsoft Windows operating system. Further analysis of this event led to us discovering a zero-day vulnerability in win32k.sys. We reported it to Microsoft on February 22, 2019. The company confirmed the vulnerability and assigned it CVE-2019-0797 . Microsoft have just released a patch, crediting Kaspersky Lab researchers Vasiliy Berdnikov and Boris Larin with the discovery:
This is the fourth consecutive exploited Local Privilege Escalation vulnerability in Windows we have discovered recently using our technologies. Just like with CVE-2018-8589 , we believe this
Trendmicro
Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
blogs_trendmicro·2018-12-12·CVSS 7.8
CVE-2018-8611 [HIGH] Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
Exploits & Vulnerabilities
## Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability (CVE-2018-8611).
By: Trend Micro Research Dec 12, 2018 Read time: ( words)
Save to Folio
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability ( CVE-2018-8611 ). The flaw allows an attacker to exploit a bug in the Windows Kernel and run arbitrary code to install programs; view, change, or delete data; or create new accounts with full user rights. It is also pointed out as likely being used with other bugs in targeted attacks.
The patch release fixes another vulnerability that’s worth noting: CVE-20
Trendmicro
Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
blogs_trendmicro·2018-12-12·CVSS 7.8
CVE-2018-8611 [HIGH] Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
Ausnutzung von Schwachstellen
## Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability (CVE-2018-8611).
By: Trend Micro Research Dec 12, 2018 Read time: ( words)
Save to Folio
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability ( CVE-2018-8611 ). The flaw allows an attacker to exploit a bug in the Windows Kernel and run arbitrary code to install programs; view, change, or delete data; or create new accounts with full user rights. It is also pointed out as likely being used with other bugs in targeted attacks.
The patch release fixes another vulnerability that’s worth noting: CVE
Trendmicro
Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
blogs_trendmicro·2018-12-12·CVSS 7.8
CVE-2018-8611 [HIGH] Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
Exploits & Vulnerabilities
# Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability (CVE-2018-8611).
By: Trend Micro Research
2018/12/12
Read time: ( words)
Save to Folio
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability (CVE-2018-8611). The flaw allows an attacker to exploit a bug in the Windows Kernel and run arbitrary code to install programs; view, change, or delete data; or create new accounts with full user rights. It is also pointed out as likely being used with other bugs in targeted attacks.
The patch release fixes another vulnerability that’s worth noting: CVE-2018-8
Securelist
Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)
blogs_securelist·2018-12-12·CVSS 7.8
CVE-2018-8611 [HIGH] Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)
Authors
- Boris Larin
- Vladislav Stolyarov
- Anton Ivanov
## Executive summary
In October 2018, our AEP (Automatic Exploit Prevention) systems detected an attempt to exploit a vulnerability in the Microsoft Windows operating system. Further analysis led us to uncover a zero-day vulnerability in ntoskrnl.exe. We reported it to Microsoft on October 29, 2018. The company confirmed the vulnerability and assigned it CVE-2018-8611. Microsoft just released a patch, part of its December update, crediting Kaspersky Lab researchers Boris Larin (Oct0xor) and Igor Soumenkov (2igosha) with the discovery.
This is the third consecutive exploited Local Privilege Escalation vulnerability in Windows we discovered this autumn using our technologies. Unlike the previously reported vulnerabilities in win3
Securelist
Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)
blogs_securelist·2018-12-12·CVSS 7.8
CVE-2018-8611 [HIGH] Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611)
Authors
Boris Larin
Vladislav Stolyarov
Anton Ivanov
## Executive summary
In October 2018, our AEP (Automatic Exploit Prevention) systems detected an attempt to exploit a vulnerability in the Microsoft Windows operating system. Further analysis led us to uncover a zero-day vulnerability in ntoskrnl.exe. We reported it to Microsoft on October 29, 2018. The company confirmed the vulnerability and assigned it CVE-2018-8611 . Microsoft just released a patch, part of its December update, crediting Kaspersky Lab researchers Boris Larin ( Oct0xor ) and Igor Soumenkov ( 2igosha ) with the discovery.
This is the third consecutive exploited Local Privilege Escalation vulnerability in Windows we discovered this autumn using our technologies. Unlike the previously reported vulnerabilities in win
Trendmicro
Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
blogs_trendmicro·2018-12-12·CVSS 7.8
CVE-2018-8611 [HIGH] Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
Exploits y vulnerabilidades
## Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability (CVE-2018-8611).
By: Trend Micro Research Dec 12, 2018 Read time: ( words)
Save to Folio
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability ( CVE-2018-8611 ). The flaw allows an attacker to exploit a bug in the Windows Kernel and run arbitrary code to install programs; view, change, or delete data; or create new accounts with full user rights. It is also pointed out as likely being used with other bugs in targeted attacks.
The patch release fixes another vulnerability that’s worth noting: CVE-2
Trendmicro
Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
blogs_trendmicro·2018-12-12·CVSS 7.8
CVE-2018-8611 [HIGH] Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
Exploits & Vulnerabilities
## Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability (CVE-2018-8611).
By: Trend Micro Research 2018/12/12 Read time: ( words)
Save to Folio
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability ( CVE-2018-8611 ). The flaw allows an attacker to exploit a bug in the Windows Kernel and run arbitrary code to install programs; view, change, or delete data; or create new accounts with full user rights. It is also pointed out as likely being used with other bugs in targeted attacks.
The patch release fixes another vulnerability that’s worth noting: CVE-2018
Trendmicro
Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
blogs_trendmicro·2018-12-12·CVSS 7.8
CVE-2018-8611 [HIGH] Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
Exploits & Vulnerabilities
## Patch Tuesday Fixes Win32k, Windows DNS Server Flaws
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability (CVE-2018-8611).
By: Trend Micro Research Dec 12, 2018 Read time: ( words)
Save to Folio
The just-released Patch Tuesday for December includes a fix for the actively exploited Win32k Elevation of Privilege Vulnerability ( CVE-2018-8611 ). The flaw allows an attacker to exploit a bug in the Windows Kernel and run arbitrary code to install programmes; view, change, or delete data; or create new accounts with full user rights. It is also pointed out as likely being used with other bugs in targeted attacks.
The patch release fixes another vulnerability that’s worth noting: CVE-
Qualys
December 2018 Patch Tuesday – 39 Vulns, Workstation Patches, Adobe Vulns
blogs_qualys·2018-12-11·CVSS 7.8
[HIGH] December 2018 Patch Tuesday – 39 Vulns, Workstation Patches, Adobe Vulns
This month’s Patch Tuesday addresses 39 vulnerabilities, with 9 of them labeled as Critical. Out of the Criticals, most are browser-related, with the rest including Windows, and .net Framework. A Privilege Escalation vulnerability exists in Windows kernel which has been exploited in wild. Adobe also patched 9 Critical and Important vulnerabilities this month for Adobe Acrobat and Reader.
On the basis of volume and severity this Patch Tuesday is light in weight.
## Workstation Patches
Browser and Scripting Engine patches should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users. Out of the 9 vulnerabilities, 6 can be exploited through br
Krebs
Patch Tuesday, December 2018 Edition
blogs_krebs·2018-12-11·CVSS 7.8
[HIGH] Patch Tuesday, December 2018 Edition
Adobe and Microsoft each released updates today to tackle critical security weaknesses in their software. Microsoft’s December patch batch is relatively light, addressing more than three dozen vulnerabilities in Windows and related applications. Adobe has issued security fixes for its Acrobat and PDF Reader products, and has a patch for yet another zero-day flaw in Flash Player that is already being exploited in the wild.
Microsoft patched a zero-day flaw that is already being exploited (CVE-2018-8611) and allows an attacker to elevate his privileges on a host system. The weakness, which is present on all supported versions of Windows, is tagged with the less severe “important” rating by Microsoft mainly because it requires an attacker to be logged on to the system first.
According to se
Krebs
Patch Tuesday, December 2018 Edition
blogs_krebs·2018-12-11·CVSS 7.8
[HIGH] Patch Tuesday, December 2018 Edition
Adobe and Microsoft each released updates today to tackle critical security weaknesses in their software. Microsoft’s December patch batch is relatively light, addressing more than three dozen vulnerabilities in Windows and related applications. Adobe has issued security fixes for its Acrobat and PDF Reader products, and has a patch for yet another zero-day flaw in Flash Player that is already being exploited in the wild.
At least nine of the bugs in the Microsoft patches address flaws the company deems “critical,” meaning they can be exploited by malware or ne’er-do-wells to install malicious software with little or no help from users, save for perhaps browsing to a hacked or booby-trapped site.
Microsoft patched a zero-day flaw that is already being exploited ( CVE-2018-8611 ) and allo
Qualys
December 2018 Patch Tuesday – 39 Vulns, Workstation Patches, Adobe Vulns | Qualys
blogs_qualys·2018-12-11·CVSS 7.8
[HIGH] December 2018 Patch Tuesday – 39 Vulns, Workstation Patches, Adobe Vulns | Qualys
This month’s Patch Tuesday addresses 39 vulnerabilities, with 9 of them labeled as Critical. Out of the Criticals, most are browser-related, with the rest including Windows, and .net Framework. A Privilege Escalation vulnerability exists in Windows kernel which has been exploited in wild. Adobe also patched 9 Critical and Important vulnerabilities this month for Adobe Acrobat and Reader.
On the basis of volume and severity this Patch Tuesday is light in weight.
### Workstation Patches
Browser and Scripting Engine patches should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users. Out of the 9 vulnerabilities, 6 can be exploited through b
Threat Intel
SandCat
threat_intel·CVSS 7.8
CVE-2018-8589 [HIGH] SandCat
# Threat Actor: SandCat
## Description
SandCat, on the other hand, is a group that was discovered more recently by Kaspersky. One of the Windows vulnerabilities patched by Microsoft in December had been exploited by both FruityArmor and SandCat in attacks targeting the Middle East and Africa. SandCat has been using FinFisher/FinSpy spyware and CHAINSHOT, a piece of malware analyzed earlier this year by Palo Alto Networks. The group has also used the CVE-2018-8589 and CVE-2018-8611 Windows vulnerabilities in its attacks, both of which had a zero-day status when Microsoft released fixes.
Zscaler
Zscaler protects against 12 new vulnerabilities for Chakra Scripting Engine, Internet Explorer, Scripting Engine, Windows VBScript Engine, Windows & Microsoft PowerPoint | Zscaler
blogs_zscaler·CVSS 7.8
[HIGH] Zscaler protects against 12 new vulnerabilities for Chakra Scripting Engine, Internet Explorer, Scripting Engine, Windows VBScript Engine, Windows & Microsoft PowerPoint | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
http://www.securityfocus.com/bid/106082https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8611http://www.securityfocus.com/bid/106082https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8611https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8611
2018-12-12
Published
2022-05-24
Added to CISA KEV
Exploited in the wild