CVE-2018-8342 - Vulnerability Details - OpenCVE

ReportizFlow

An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it, aka "Windows NDIS Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8343.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:L/AC:L/Au:N/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Windows 7 Windows Server 2008

Configuration 1 [-]

OR	cpe:2.3:o:microsoft:windows_7:-:sp1::::::
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1::::::

No data.

References

Link	Providers
http://www.securityfocus.com/bid/104975
http://www.securitytracker.com/id/1041466
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8342

History

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00254}`	epss `{'score': 0.00244}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2018-08-15T17:00:00

Updated: 2024-08-05T06:54:35.307Z

Reserved: 2018-03-14T00:00:00

Link: CVE-2018-8342

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-08-15T17:29:04.173

Modified: 2024-11-21T04:13:39.017

Link: CVE-2018-8342

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Windows 7", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "32-bit Systems Service Pack 1"}, {"status": "affected", "version": "x64-based Systems Service Pack 1"}]}, {"product": "Windows Server 2008 R2", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "Itanium-Based Systems Service Pack 1"}, {"status": "affected", "version": "x64-based Systems Service Pack 1"}, {"status": "affected", "version": "x64-based Systems Service Pack 1 (Server Core installation)"}]}], "datePublic": "2018-08-14T00:00:00", "descriptions": [{"lang": "en", "value": "An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it, aka \"Windows NDIS Elevation of Privilege Vulnerability.\" This affects Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8343."}], "problemTypes": [{"descriptions": [{"description": "Elevation of Privilege", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-08-16T09:57:01", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"name": "104975", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/104975"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8342"}, {"name": "1041466", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1041466"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2018-8342", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Windows 7", "version": {"version_data": [{"version_value": "32-bit Systems Service Pack 1"}, {"version_value": "x64-based Systems Service Pack 1"}]}}, {"product_name": "Windows Server 2008 R2", "version": {"version_data": [{"version_value": "Itanium-Based Systems Service Pack 1"}, {"version_value": "x64-based Systems Service Pack 1"}, {"version_value": "x64-based Systems Service Pack 1 (Server Core installation)"}]}}]}, "vendor_name": "Microsoft"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it, aka \"Windows NDIS Elevation of Privilege Vulnerability.\" This affects Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8343."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Elevation of Privilege"}]}]}, "references": {"reference_data": [{"name": "104975", "refsource": "BID", "url": "http://www.securityfocus.com/bid/104975"}, {"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8342", "refsource": "CONFIRM", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8342"}, {"name": "1041466", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1041466"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:54:35.307Z"}, "title": "CVE Program Container", "references": [{"name": "104975", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/104975"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8342"}, {"name": "1041466", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1041466"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2018-8342", "datePublished": "2018-08-15T17:00:00", "dateReserved": "2018-03-14T00:00:00", "dateUpdated": "2024-08-05T06:54:35.307Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*", "matchCriteriaId": "C2B1C231-DE19-4B8F-A4AA-5B3A65276E46", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*", "matchCriteriaId": "2ACA9287-B475-4AF7-A4DA-A7143CEF9E57", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it, aka \"Windows NDIS Elevation of Privilege Vulnerability.\" This affects Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8343."}, {"lang": "es", "value": "Existe una vulnerabilidad de elevaci\u00f3n de privilegios en Network Driver Interface Specification (NDIS) cuando ndis.sys no comprueba correctamente la longitud de un b\u00fafer antes de copiar memoria en \u00e9l. Esto tambi\u00e9n se conoce como \"Windows NDIS Elevation of Privilege Vulnerability\". Esto afecta a Windows 7 y Windows 2008 R2. El ID de este CVE es diferente de CVE-2018-8343."}], "id": "CVE-2018-8342", "lastModified": "2024-11-21T04:13:39.017", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2018-08-15T17:29:04.173", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/104975"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1041466"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8342"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/104975"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1041466"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8342"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "[email protected]", "type": "Primary"}]}