vulnwire
8.5high

CVE-2019-1019in critical feed1 exploit

Microsoft Windows Security Feature Bypass Vulnerability

Published 7 y ago · modified 4 mo ago · JSON

CVSS
8.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
15.1%
percentile 97%
Public exploits
1
Exploit-DB

A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages. To exploit this vulnerability, an attacker could send a specially crafted authentication request. An attacker who successfully exploited this vulnerability could access another machine using the original user privileges. The issue has been addressed by changing how NTLM validates network authentication messages.

Exploit prediction (EPSS)

15.12% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

Exploits and detections

  • EDB-47115 Microsoft Windows 10.0.17134.648 - HTTP -> SMB NTLM Reflection Leads to Privilege Elevation · local · 2019-07-12

CVSS scores

Assigned byVersionScoreVector
CNA3.18.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
CNA3.18.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA3.08.5CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD2.06.0AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected products

  • Microsoft Windows 10 Version 1703
  • Microsoft Windows 10 Version 1803
  • Microsoft Windows Server, version 1803 (Server Core Installation)
  • Microsoft Windows 10 Version 1809
  • Microsoft Windows Server 2019
  • Microsoft Windows Server 2019 (Server Core installation)
  • Microsoft Windows 10 Version 1709 for 32-bit Systems
  • Microsoft Windows 10 Version 1709
  • Microsoft Windows 10 Version 1903 for 32-bit Systems
  • Microsoft Windows 10 Version 1903 for x64-based Systems
  • Microsoft Windows 10 Version 1903 for ARM64-based Systems
  • Microsoft Windows Server, version 1903 (Server Core installation)
  • Microsoft Windows 10 Version 1507
  • Microsoft Windows 10 Version 1607
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2016 (Server Core installation)
  • Microsoft Windows 7
  • Microsoft Windows 7 Service Pack 1
  • Microsoft Windows 8.1
  • Microsoft Windows Server 2008 Service Pack 2
  • Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)
  • Microsoft Windows Server 2008 Service Pack 2
  • Microsoft Windows Server 2008 R2 Systems Service Pack 1
  • Microsoft Windows Server 2008 R2 Service Pack 1
  • Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)
  • Microsoft Windows Server 2012
  • Microsoft Windows Server 2012 (Server Core installation)
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows Server 2012 R2 (Server Core installation)

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • msrc.microsoft.com /update-guide/vulnerability/CVE-2019-1019 · vendor-advisory
  • portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2019-1019 · x_refsource_MISC, x_transferred
  • packetstormsecurity.com /files/153639/Microsoft-Windows-HTTP-To-SMB-NTLM-Reflection-Privilege-Escalation.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.