Vulnerability-Lookup

CNVD-2018-05740

Vulnerability from cnvd - Published: 2018-03-20

Title

Microsoft Windows Scripting Host安全绕过漏洞

Description

Microsoft Windows是美国微软（Microsoft）公司发布的一系列操作系统。Windows Scripting Host（WSH）是其中的一个内嵌于系统中的脚本运行环境。 Microsoft Windows 10版本1703、1709和Windows Server版本1709中的WSH存在安全功能绕过漏洞。本地攻击者可通过访问本地设备并运行恶意程序利用该漏洞绕过User Mode Code Integrity (UMCI)策略。

Severity

中

Patch Name

Microsoft Windows Scripting Host安全绕过漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0827

Reference

http://www.securityfocus.com/bid/102927

Impacted products

Name
['Microsoft Windows 10 1703', 'Microsoft Windows 10 1709', 'Microsoft Windows Server 1709']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "102927"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-0827"
    }
  },
  "description": "Microsoft Windows\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u53d1\u5e03\u7684\u4e00\u7cfb\u5217\u64cd\u4f5c\u7cfb\u7edf\u3002Windows Scripting Host\uff08WSH\uff09\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u5185\u5d4c\u4e8e\u7cfb\u7edf\u4e2d\u7684\u811a\u672c\u8fd0\u884c\u73af\u5883\u3002\r\n\r\nMicrosoft Windows 10\u7248\u672c1703\u30011709\u548cWindows Server\u7248\u672c1709\u4e2d\u7684WSH\u5b58\u5728\u5b89\u5168\u529f\u80fd\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bbf\u95ee\u672c\u5730\u8bbe\u5907\u5e76\u8fd0\u884c\u6076\u610f\u7a0b\u5e8f\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7User Mode Code Integrity (UMCI)\u7b56\u7565\u3002",
  "discovererName": "Matt Nelson (@enigma0x3) of SpecterOps",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0827",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-05740",
  "openTime": "2018-03-20",
  "patchDescription": "Microsoft Windows\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u53d1\u5e03\u7684\u4e00\u7cfb\u5217\u64cd\u4f5c\u7cfb\u7edf\u3002Windows Scripting Host\uff08WSH\uff09\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u5185\u5d4c\u4e8e\u7cfb\u7edf\u4e2d\u7684\u811a\u672c\u8fd0\u884c\u73af\u5883\u3002\r\n\r\nMicrosoft Windows 10\u7248\u672c1703\u30011709\u548cWindows Server\u7248\u672c1709\u4e2d\u7684WSH\u5b58\u5728\u5b89\u5168\u529f\u80fd\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bbf\u95ee\u672c\u5730\u8bbe\u5907\u5e76\u8fd0\u884c\u6076\u610f\u7a0b\u5e8f\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7User Mode Code Integrity (UMCI)\u7b56\u7565\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Windows Scripting Host\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Windows 10 1703",
      "Microsoft Windows 10 1709",
      "Microsoft Windows Server 1709"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/102927",
  "serverity": "\u4e2d",
  "submitTime": "2018-02-26",
  "title": "Microsoft Windows Scripting Host\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2018-0827 (GCVE-0-2018-0827)

Vulnerability from cvelistv5 – Published: 2018-02-15 02:00 – Updated: 2024-09-16 18:38

Summary

Windows Scripting Host (WSH) in Windows 10 versions 1703 and 1709 and Windows Server, version 1709 allows a Device Guard security feature bypass vulnerability due to the way objects are handled in memory, aka "Windows Security Feature Bypass Vulnerability".

Severity

No CVSS data available.

CWE

Important

Assigner

microsoft mitre root Scorecard

References

3 references

URL	Tags
http://www.securityfocus.com/bid/102927	vdb-entryx_refsource_BID
https://portal.msrc.microsoft.com/en-US/security-…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1040373	vdb-entryx_refsource_SECTRACK

Impacted products

1 product

Vendor	Product	Version
Microsoft Corporation	Windows Scripting Host	Affected: Windows 10 versions 1703 and 1709 and Windows Server, version 1709

Date Public

2018-02-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:35:49.477Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "102927",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/102927"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0827"
          },
          {
            "name": "1040373",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1040373"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Windows Scripting Host",
          "vendor": "Microsoft Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Windows 10 versions 1703 and 1709 and Windows Server, version 1709"
            }
          ]
        }
      ],
      "datePublic": "2018-02-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Windows Scripting Host (WSH) in Windows 10 versions 1703 and 1709 and Windows Server, version 1709 allows a Device Guard security feature bypass vulnerability due to the way objects are handled in memory, aka \"Windows Security Feature Bypass Vulnerability\"."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Important",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-15T10:57:01.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "102927",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/102927"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0827"
        },
        {
          "name": "1040373",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1040373"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "DATE_PUBLIC": "2018-02-13T00:00:00",
          "ID": "CVE-2018-0827",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Windows Scripting Host",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Windows 10 versions 1703 and 1709 and Windows Server, version 1709"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Windows Scripting Host (WSH) in Windows 10 versions 1703 and 1709 and Windows Server, version 1709 allows a Device Guard security feature bypass vulnerability due to the way objects are handled in memory, aka \"Windows Security Feature Bypass Vulnerability\"."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Important"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "102927",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/102927"
            },
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0827",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0827"
            },
            {
              "name": "1040373",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1040373"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2018-0827",
    "datePublished": "2018-02-15T02:00:00.000Z",
    "dateReserved": "2017-12-01T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:38:31.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2018-05740

CVE-2018-0827 (GCVE-0-2018-0827)

Tags

Sightings

Nomenclature

Related by attack behaviour