CVE-2018-0824 in microsoft windows 10 1507
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Affected software: microsoft windows 10 1507, microsoft windows 10 1607, microsoft windows 10 1703, microsoft windows 10 1709, microsoft windows 10 1803, microsoft windows 7, microsoft windows 8.1, microsoft windows rt 8.1, microsoft windows server 1709, microsoft windows server 1803
Scores
- CVSS: 8.8 (high)
- EPSS: 73.04% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2024-08-05
- Published: 2018-05-09
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Install the May 2018 (or later) Windows security update for Microsoft COM (CVE-2018-0824)
Patch or upgrade. The May 2018 Windows security update corrects how Microsoft COM for Windows handles serialized objects, removing the deserialization flaw that is used for code execution and local privilege escalation. Any later cumulative update also contains the fix.
Applies to: Windows 7, 8.1, RT 8.1, Windows 10 1507-1803, Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 1709 and 1803 without the May 2018 security update or a later one.
- Inventory Windows hosts on the affected versions: Windows 7 SP1, 8.1, RT 8.1, Windows 10 (1507, 1607, 1703, 1709, 1803), Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 1709 and 1803.
- Check the installed updates on each host (Settings > Update & Security > Update history, or run 'Get-HotFix' in PowerShell) and compare against the May 2018 update for that version, or any later cumulative/monthly rollup.
- Windows 10 / Server 2016: install the current cumulative update for the build (May 2018 packages: 1507 KB4103716, 1607/Server 2016 KB4103723, 1703 KB4103731, 1709 KB4103727, 1803 KB4103721).
- Windows 7 SP1 / Server 2008 R2 SP1: install the latest Monthly Rollup (May 2018: KB4103718, or Security-only KB4103712). These versions are out of support; ESU or upgrade is required for current fixes.
- Windows 8.1 / Server 2012 R2: install the latest Monthly Rollup (May 2018: KB4103725, or Security-only KB4103715).
- Windows Server 2012: install the latest Monthly Rollup (May 2018: KB4103730, or Security-only KB4103726).
- Windows Server 2008 SP2: install the May 2018 security update listed for CVE-2018-0824 in the Microsoft Security Update Guide, or a later rollup.
- Deploy via WSUS, Configuration Manager, Intune or Windows Update for Business, and reboot the hosts.
- Confirm with a vulnerability scan that CVE-2018-0824 is no longer reported; replace or isolate end-of-life systems that cannot be patched.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.