CVE-2018-0833 — Windows Denial of Service Vulnerability
Executive Summary
A denial of service vulnerability exists in implementations of the Microsoft Server Message Block 2.0 and 3.0 (SMBv2/SMBv3) client. The vulnerability is due to improper handling of certain requests sent by a malicious SMB server to the client. An attacker who successfully exploited this vulnerability could cause the affected system to stop responding until it is manually restarted. To exploit the vulnerability, an attacker could use various methods such as redirectors, injected HTML header links, etc., which could cause the SMB client to connect to a malicious SMB server. The security update addresses the vulnerability by correcting how the Microsoft SMBv2/SMBv3 Client handles specially crafted requests.
Overview
CVSS Vector
EPSS Score
No EPSS score available for this CVE.
View on FIRST.orgAffected Products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 8.1 for 32-bit systems 4074594 (Monthly Rollup) 4074597 (Security Only) Moderate Denial of Service 4056895 Base: 4.8 Temporal: 4.3 Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C Yes None Windows 8.1 for x64-based systems 4074594 (Monthly Rollup) 4074597 (Security Only) Moderate Denial of Service 4056895 Base: 4.8 Temporal: 4.3 Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C Yes None Windows RT 8.1 | 4074594 (Monthly Rollup) |
Moderate | Denial of Service | Yes |
Patches
| Article | Type | Restart |
|---|---|---|
4074594 |
Monthly Rollup | Yes |
Known Exploits
Acknowledgments
Nabeel Ahmed and Eric Schayes from Dimension Data working with Trend Micro's Zero Day Initiative