CVE-2019-1365

EUVD-2019-9923

10.10.2019, 14:15

An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\system escaping the Sandbox.The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests., aka 'Microsoft IIS Server Elevation of Privilege Vulnerability'.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.9 CRITICAL	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 83%

Affected Products (NVD)

Vendor	Product	Version
microsoft	windows_7	-
microsoft	windows_8.1	-
microsoft	windows_rt_8.1	-
microsoft	windows_server_2008	-
microsoft	windows_server_2012	-
microsoft	windows_server_2016	-
microsoft	windows_server_2019	-

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

1607 (x64, x86)	KB4519998
1803 (arm64, x64, x86)	KB4520008
1809 (arm64, x64, x86)	KB4519338
1903 (arm64, x64, x86)	KB4517389

Windows 7

Service Pack 1 (x64, x86)

KB4520003

Windows 8.1

(x64, x86)

KB4520005

Windows RT 8.1

All

KB4520005

Windows Server

1803 Server Core	KB4520008
1903 Server Core	KB4517389

Windows Server 2008

Service Pack 2 (x64, x86)	KB4520009
Service Pack 2 Server Core (x64, x86)	KB4520009

Windows Server 2008 R2

Service Pack 1 (x64)	KB4520003
Service Pack 1 Server Core (x64)	KB4520003

Windows Server 2012

Server Core	KB4520007
Standard	KB4520007

Windows Server 2012 R2

Server Core	KB4520005
Standard	KB4520005

Windows Server 2016

Server Core	KB4519998
Standard	KB4519998

Windows Server 2019

Server Core	KB4519338
Standard	KB4519338

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1365