Accessibility Options |  Sitemap |  Contact Us
   
 
 
 
HOME space ABOUTCERTIn space KNOWLEDGEBASE space TRAINING space ADVISORIES space VULNOTES space space Facebook space x space insta space youtube space Linkedin
WLine
DigitalIndia
WLine
csk
WLine
Full Member FIRST
Line
Operational Member TFCSIRT
Line
Accredited Member APCERT
Line
Global Research Partner APWG
Line
Associate Partner Charter
Line
CNA
WLine
 Directions by CERT-In under  Section 70B, Information  Technology Act 2000
WLine
 Guidelines on Information  Security Practices for  Government Entities
WLine
 Technical Guidelines on NEW  SOFTWARE BILL OF MATERIALS  (SBOM)
WLine
 Cyber Security GuidelinesNEW  for Smart City Infrastructure
About CERT-in
Line
point point Client's /Citizen's Charter
Line
point point Roles & Functions
Line
point point Advisory Committee
Line
point point Act/Rules/Regulations
Line
point point Internal Complaint Committee         (ICC) 
Line
point point RFC2350 
line
point point Press  
Line
point point Tender 
Line
point point Subscribe Mailing List
Line
point point Contact Us
Line
Line
Reporting
point
 Incident Reporting
point
Line
point
 Vulnerability Reporting
point
Line
point
 Feedback
point
Line
KnowledgeBase
Line
point Point Guidelines
Line
point Point Presentations
Line
point Point White Papers 
Line
point Point Annual Report 
Line
Line
Line
line
Line
line
line
Advisories
Line
VulnerabilityNotes
Line
RelatedLinks
Line
point Point World CERTs
Line
point point Antivirus Resources
line
point point FAQ
line
line
Line
Line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
spacer
Home - Vulnerability NotesPrint
point
CERT-In Vulnerability Note CIVN-2017-0183
Multiple Vulnerabilities in Microsoft Windows

Original Issue Date:December 14, 2017

Severity Rating: HIGH

Software Affected

  • Windows 7 for 32-bit Systems SP1 and x64-based Systems SP1
  • Microsoft Windows 8.1 for 32-bit Systems and x64-based Systems
  • Microsoft Windows RT 8.1
  • Windows 10 for 32-bit Systems and x64-based Systems
  • Windows 10 Version 1511 for 32-bit Systems and x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems and x64-based Systems
  • Windows 10 Version 1703 for 32-bit Systems and x64-based Systems
  • Windows 10 Version 1709 for 32-bit Systems and x64-based Systems
  • Microsoft Windows Server 2008 R2 32-bit Systems, x64-based Systems and Itanium-based Systems SP2
  • Windows Server 2008 R2 for x64-based Systems SP1 and Itanium-Based Systems SP1
  • Microsoft Windows Server 2012
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows Server 2016
  • Windows Server 2008 for 32-bit Systems SP 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems SP 2 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems SP 1 (Server Core installation)
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016  (Server Core installation)
  • Windows Server Version 1709  (Server Core Installation)

Overview

Multiple vulnerabilities have been reported in Microsoft Windows which could allow an attacker to execute arbitrary code on the targeted system, bypass security restrictions, or obtain sensitive information.

Description

1. RRAS Service Remote Code Execution Vulnerability ( CVE-2017-11885   )

This vulnerability is due to improper handling of requests performed by the RRAS enabled RPC server. A remote attacker could exploit this vulnerability by executing a specially crafted application against the RPC server to execute remote code. If the current logged in user has elevated privileges, the attacker could completely compromise the system.

2. Security Feature Bypass Vulnerability ( CVE-2017-11899   )

This vulnerability exists in the Device Guard component of Microsoft Windows due to incorrect validation of an untrusted file. An attacker could exploit this vulnerability by accessing the system and executing an unsigned application which submits malicious input to the affected software.
Successful exploitation of this vulnerability could allow the attacker to bypass Device Guard security restrictions which could lead to further attacks.

3. Information Disclosure Vulnerability ( CVE-2017-11927   )

This vulnerability exists in the  its:// protocol handler of Microsoft Windows due to an error while sending traffic to a remote site to determine the zone of a provided URL. A remote attacker could exploit this vulnerability by enticing the user to visit a malicious website or SMB or UNC path destination.
Successful exploitation of this vulnerability could allow the attacker to obtain the user's NTLM hash and attempt a brute-force attack resulting in disclosure of the corresponding user¿s password.

Solution

Apply appropriate patches as mentioned in Microsoft Security Guidance
https://portal.msrc.microsoft.com/en-us/security-guidance

Vendor Information

Microsoft
https://portal.msrc.microsoft.com/en-us/security-guidance

References

Microsoft
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11885
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11899
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11927

Cisco
https://tools.cisco.com/security/center/viewAlert.x?alertId=56130
https://tools.cisco.com/security/center/viewAlert.x?alertId=56140
https://tools.cisco.com/security/center/viewAlert.x?alertId=56156

Security Tracker
https://www.securitytracker.com/id/1039987
https://www.securitytracker.com/id/1039992
https://www.securitytracker.com/id/1039997

CVE Name
CVE-2017-11885
CVE-2017-11899
CVE-2017-11927

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India

 
Indian Computer Emergency Response Team - CERT-In, Ministry of Electronics and Information Technology, Government of India.
Website Policies |  Terms of Use |  Help Last Updated On May 01, 2025