Summaryinfo

A vulnerability was found in Microsoft RMS Sharing for Mac and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to privileges management. This vulnerability is handled as CVE-2020-1019. The attack may be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Detailsinfo

A vulnerability has been found in Microsoft RMS Sharing for Mac (the affected version is unknown) and classified as critical. Affected by this vulnerability is an unknown code. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An elevation of privilege vulnerability exists in RMS Sharing App for Mac in the way it allows an attacker to load unsigned binaries, aka 'Microsoft RMS Sharing App for Mac Elevation of Privilege Vulnerability'.

The weakness was presented 04/14/2020 as confirmed security update guide (Website). It is possible to read the advisory at portal.msrc.microsoft.com. The public release was coordinated in cooperation with Microsoft. This vulnerability is known as CVE-2020-1019. The attack can be launched remotely. A single authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK. The advisory points out:

An elevation of privilege vulnerability exists in RMS Sharing App for Mac in the way it allows an attacker to load unsigned binaries. An attacker could then install programs; view, change, or delete data with the logged in user's privileges.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Microsoft

Name

• RMS Sharing for Mac

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion