SB2018050837 - Security restrictions bypass in Microsoft Windows
Published: May 8, 2018
Security Bulletin ID
SB2018050837
Severity
Low
Patch available
YES
Number of vulnerabilities
5
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Security restrictions bypass (CVE-ID: CVE-2018-0854)
The vulnerability allows a local attacker to bypass security restriction on the target system.The weakness exists due to improper validation of User Mode Code Integrity policies. A local attacker can run a malicious program, bypass Device Guard and circumvent a User Mode Code Integrity (UMCI) policy on the machine.
2) Security restrictions bypass (CVE-ID: CVE-2018-0958)
The vulnerability allows a local attacker to bypass security restriction on the target system.The weakness exists due to improper validation of User Mode Code Integrity policies. A local attacker can run a malicious program, bypass Device Guard and circumvent a User Mode Code Integrity (UMCI) policy on the machine.
3) Security restrictions bypass (CVE-ID: CVE-2018-8129)
The vulnerability allows a local attacker to bypass security restriction on the target system.The weakness exists due to improper validation of User Mode Code Integrity policies. A local attacker can run a malicious program, bypass Device Guard and circumvent a User Mode Code Integrity (UMCI) policy on the machine.
4) Security restrictions bypass (CVE-ID: CVE-2018-8132)
The vulnerability allows a local attacker to bypass security restriction on the target system.The weakness exists due to improper validation of User Mode Code Integrity policies. A local attacker can run a malicious program, bypass Device Guard and circumvent a User Mode Code Integrity (UMCI) policy on the machine.
5) Security restrictions bypass (CVE-ID: CVE-2018-8142)
The vulnerability allows a remote attacker to bypass security restriction on the target system.The weakness exists due to Windows incorrectly validates kernel driver signatures. A remote attacker can bypass security features and load improperly signed drivers into the kernel.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0854
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0958
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8129
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8132
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8142