漏洞描述
The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709 Windows Server 2016 and Windows Server, version 1709 allows a remote code execution vulnerability due to how CredSSP validates request during the authentication process, aka "CredSSP Remote Code Execution Vulnerability".
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
portal.msrc.microsoft.comhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0886↗github.comhttps://github.com/preempt/credssp↗www.securitytracker.comhttp://www.securitytracker.com/id/1040506↗blog.preempt.comhttps://blog.preempt.com/security-advisory-credssp↗ics-cert.us-cert.govhttps://ics-cert.us-cert.gov/advisories/ICSA-18-198-03↗www.securityfocus.comhttp://www.securityfocus.com/bid/103265↗