CVE-2019-1212

EUVD-2019-9780

14.08.2019, 21:15

A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets. An attacker who successfully exploited the vulnerability could cause the DHCP server service to stop responding.
To exploit the vulnerability, a remote unauthenticated attacker could send a specially crafted packet to an affected DHCP server.
The security update addresses the vulnerability by correcting how DHCP servers handle network packets.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
microsoft	CNA	9.8 CRITICAL				CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Base Score

CVSS 3.x

EPSS Score

Percentile: 95%

Affected Products (NVD)

Vendor	Product	Version
microsoft	windows_7	-
microsoft	windows_8.1	-
microsoft	windows_rt_8.1	-
microsoft	windows_server_2008	-
microsoft	windows_server_2012	-
microsoft	windows_server_2016	-
microsoft	windows_server_2019	-

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

1607 (x64, x86)	KB4512517
1709 (arm64, x64, x86)	KB4512516
1803 (arm64, x64, x86)	KB4512501
1809 (arm64, x64, x86)	KB4511553
1903 (arm64, x64, x86)	KB4512508

Windows 7

Service Pack 1 (x64, x86)

KB4512506

Windows 8.1

(x64, x86)

KB4512489

Windows RT 8.1

All

KB4512488

Windows Server

1803 Server Core	KB4512501
1903 Server Core	KB4512508

Windows Server 2008

Service Pack 2 (x64, x86)	KB4512491
Service Pack 2 Server Core (x64, x86)	KB4512491

Windows Server 2008 R2

Service Pack 1 (x64)	KB4512506
Service Pack 1 Server Core (x64)	KB4512506

Windows Server 2012

Server Core	KB4512518
Standard	KB4512518

Windows Server 2012 R2

Server Core	KB4512489
Standard	KB4512489

Windows Server 2016

Server Core	KB4512517
Standard	KB4512517

Windows Server 2019

Server Core	KB4511553
Standard	KB4511553

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1212