Windows 10: Get-SpeculationControlSettings not checking for CVE-2017-5753?

Discus and support Get-SpeculationControlSettings not checking for CVE-2017-5753? in AntiVirus, Firewalls and System Security to solve the problem; Hi all, Am I missing something here? Get-SpeculationControlSettings seems to check for 2017-5754 (Meltdown) and 2017-5715 (one part of Spectre) but... Discussion in 'AntiVirus, Firewalls and System Security' started by GreenSparrow, Jan 9, 2018.

  1. Get-SpeculationControlSettings not checking for CVE-2017-5753?


    Hi all,

    Am I missing something here? Get-SpeculationControlSettings seems to check for 2017-5754 (Meltdown) and 2017-5715 (one part of Spectre) but not CVE-2017-5753 (the other part of spectre).

    I've gotta be misunderstanding something here, right?

    Thanks in advance!

    :)
     
    GreenSparrow, Jan 9, 2018
    #1

  2. ETA of patch for "KRACK". Was this patched previously or should we expect a patch soon?

    We are looking for information that suggest when "Key Reinstallation Attack" will be patched for Windows 10 Professional. Has it been patched in an earlier update? This vulnerability has also been dubbed as "KRACK". This vulnerability is being tracked
    as CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088.
     
    Richard Bruins, Jan 9, 2018
    #2
  3. ola_erik Win User
    WPA2 Wifi KRACK & Windows update

    I'd like an update on this. This is what I've found so far:

    Type of attack

    CVE IDs

    Devices impacted

    IOS

    MacOS

    tvOS

    watchOS

    Windows

    4-way handshake

    CVE-2017-13077

    WiFi clients

    11.1

    10.13

    11.1

    4.1

    ------

    Group-key handshake

    CVE-2017-13078

    CVE-2017-13079

    CVE-2017-13080

    CVE-2017-13081

    CVE-2017-13087

    CVE-2017-13088

    WiFi clients

    11.1

    -----

    11.1

    -----

    -----

    -----

    10.13

    ------

    10.13

    ------

    ------

    ------

    11.1

    -----

    11.1

    -----

    -----

    -----

    4.1

    ------

    4.1

    ------

    ------

    ------

    ------

    ------

    Oct16

    ------

    ------

    ------

    802.11r Fast-BSS Transition (FT)

    CVE-2017-13082

    Access points

    Peer-key handshake

    CVE-2017-13084

    CVE-2017-13086

    WiFi clients

    -----

    -----

    ------

    ------

    -----

    -----

    ------

    ------

    ------

    ------

    Kudos to Zyxel for clear and exemplary info:Zyxel security advisory for the key management vulnerabilities of WPA2 protocol | Zyxel
     
    ola_erik, Jan 9, 2018
    #3
  4. EdTittel Win User

    Get-SpeculationControlSettings not checking for CVE-2017-5753?

    AFAIK the two CVEs that Get-SpeculationControls checks for are the ones you mentioned. To the best of my knowledge that tool does not check for 5753 at all. Never seen any mention of that in discussions of the tool or the remediation of those vulnerabilities.
    HTH,
    --Ed--
     
    EdTittel, Jan 15, 2018
    #4
  5. I think I have an answer, if it's helpful. It came from another forum, but I wanted to share it in case it's useful:

    "
    The main goal of this PowerShell script, is not to test if your CPU is vulnerable or to test if the patches have been installed. The main goal is to check if the mitigations are active.

    The mitigations for CVE-2017-5754 and CVE-2017-5715 are configurable (can be enabled or disabled via registry: https://support.microsoft.com/en-za/...tive-execution), and mitigating CVE-2017-5715 requires a microcode update.

    The mitigation for CVE-2017-5753 is not configurable, and does not require a microcode update.

    If the Windows patch for Meltdown/Spectre has been installed on your machine, then mitigation for CVE-2017-5753 is active.

    https://support.microsoft.com/en-za/help/4074629/understanding-the-output-of-get-speculationcontrolsettings-powershell"
     
    GreenSparrow, Jan 15, 2018
    #5
  6. EdTittel Win User
    Very helpful, and a great explanation to share. I learned something both useful and valuable. Thanks!
    --Ed--
     
    EdTittel, Apr 5, 2018
    #6
Thema:

Get-SpeculationControlSettings not checking for CVE-2017-5753?

Loading...
  1. Get-SpeculationControlSettings not checking for CVE-2017-5753? - Similar Threads - SpeculationControlSettings checking CVE

  2. CVE Warning in Kernel Process

    in Windows 10 Drivers and Hardware
    CVE Warning in Kernel Process: I am using Redline to inspect processes on a Windows 10 laptop. Redline has reported instances of a Warning in the services.exe process with a CVE: 53 message. The message is as follows: Possible detection of CVE: 53 Additional Information:...
  3. CVE-2020-0601 Patch Fails

    in Windows 10 Installation and Upgrade
    CVE-2020-0601 Patch Fails: With the recent release of patches for the CVE-2020-0601 vulnerability, I have been working to address patching for Windows 10, Server 2016, and Server 2019 machines that my office manages. Our RMM tool has been able to apply patches to many machines, however I have also...
  4. CVE-2019-1181, CVE-2019-1182, CVE-2019-1222 et CVE-2019-1226c: Pbm deploy KB

    in Windows 10 Installation and Upgrade
    CVE-2019-1181, CVE-2019-1182, CVE-2019-1222 et CVE-2019-1226c: Pbm deploy KB: Hello, i try to patch our PCs with KB for the CVE-2019-1181, CVE-2019-1182, CVE-2019-1222 et CVE-2019-1226 first try to deploy manualy ( before usins WSUS ) , but i have some problems with many KBs : KB4512508 , kb4512488 .... i have this error : [ATTACH] thanks...
  5. To mitigate meltdown insecurity threat CVE-2017-5754 Rogue Data Access using C/C++ high...

    in AntiVirus, Firewalls and System Security
    To mitigate meltdown insecurity threat CVE-2017-5754 Rogue Data Access using C/C++ high...: I have a query on spectre and meltdown insecurity threats to modern CPUs. How can software developers can mitigate these in their c/c++ code. I have a query Can we mitigate meltdown variant CVE-2017-5754 called as Rogue Data Access in c/c++ logic? or in MSVC compiler? or in...
  6. "check for updates" gets none available

    in Windows 10 Installation and Upgrade
    "check for updates" gets none available: My older laptop updated to V1903 just find. My newer gateway laptop does not see any updates available. Both have been good and operating normally with V1809...
  7. Enable Retpoline to mitigate Spectre variant 2 (CVE-2017-5715)

    in AntiVirus, Firewalls and System Security
    Enable Retpoline to mitigate Spectre variant 2 (CVE-2017-5715): Following the release of Cumulative Update KB4482887 Windows 10 v1809 Build 17763.348 there is a lot of discussion regarding the new Retpoline mitigation. This feature has been included in the KB4482887, but is disabled by default. In future updates, or the next Feature...
  8. SQLITE vulnerability CVE-2018-20346, CVE-2018-20505, CVE-2018-20506

    in AntiVirus, Firewalls and System Security
    SQLITE vulnerability CVE-2018-20346, CVE-2018-20505, CVE-2018-20506: There is a reported vulnerability in older versions of SQLITE: See 21th Dec 2018 CVE ID has been assigned as CVE-2018-20346, CVE-2018-20505, CVE-2018-20506 https://blade.tencent.com/magellan/index_en.html and https://worthdoingbadly.com/sqlitebug/ However, I see that the...
  9. Exploit for CVE-2017-8759 detected and neutralized

    in Windows 10 News
    Exploit for CVE-2017-8759 detected and neutralized: The September 12, 2017 security updates from Microsoft include the patch for a previously unknown vulnerability exploited through Microsoft Word as an entry vector. Customers using Microsoft advanced threat solutions were already protected against this threat. The...
  10. CVE-2017-5703 - Unsafe Opcodes exposed in Intel SPI based products

    in Windows 10 News
    CVE-2017-5703 - Unsafe Opcodes exposed in Intel SPI based products: Unsafe Opcodes exposed in Intel SPI based products Intel ID: INTEL-SA-00087 Product family: Multiple Generations Impact of vulnerability: Denial of Service Severity rating: Important Original release: Apr 03, 2018 Last revised: Apr 03, 2018 Summary:...