Microsoft Windows up to Server 2019 RPCSS rpcss.dll access control

Summaryinfo

A vulnerability was found in Microsoft Windows. It has been declared as critical. Affected by this issue is some unknown functionality in the library rpcss.dll of the component RPCSS. The manipulation results in access control. This vulnerability is identified as CVE-2019-1089. The attack is only possible with local access. Additionally, an exploit exists. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as critical has been found in Microsoft Windows (Operating System). Affected is some unknown processing in the library rpcss.dll of the component RPCSS. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An elevation of privilege vulnerability exists in rpcss.dll when the RPC service Activation Kernel improperly handles an RPC request. To exploit this vulnerability, a low level authenticated attacker could run a specially crafted application. The security update addresses this vulnerability by correcting how rpcss.dll handles these requests., aka 'Windows RPCSS Elevation of Privilege Vulnerability'.

The weakness was released 07/09/2019 as confirmed security update guide (Website). The advisory is shared for download at portal.msrc.microsoft.com. The public release was coordinated with the vendor. This vulnerability is traded as CVE-2019-1089 since 11/26/2018. The attack needs to be approached locally. Required for exploitation is a authentication. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1068. The advisory points out:

An elevation of privilege vulnerability exists in rpcss.dll when the RPC service Activation Kernel improperly handles an RPC request.

The exploit is shared for download at packetstormsecurity.com. It is declared as proof-of-concept. As 0-day the estimated underground price was around $5k-$25k.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47135). Entries connected to this vulnerability are available at VDB-137552, VDB-137555, VDB-137559 and VDB-137560. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7 SP1
• 8.1
• 10
• 10 1607
• 10 1703
• 10 1709
• 10 1803
• 10 1809
• 10 1903
• RT 8.1
• Server 1803
• Server 1903
• Server 2008 R2 SP1
• Server 2008 SP2
• Server 2012
• Server 2016
• Server 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion