SB2019100901 - Privilege escalation in Microsoft IIS Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019100901

SB2019100901 - Privilege escalation in Microsoft IIS Server

Published: October 9, 2019

Security Bulletin ID SB2019100901
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Buffer overflow (CVE-ID: CVE-2019-1365)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green


The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it. A remote authenticated user can use a specially crafted application to trigger memory corruption and execute arbitrary code in the context of NT AUTHORITY\system escaping the Sandbox.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References