Microsoft Windows 10 1809/10 1903/Server 1903/Server 2019 NTFS access control

Summaryinfo

A vulnerability was found in Microsoft Windows 10 1809/10 1903/Server 1903/Server 2019. It has been classified as critical. This issue affects some unknown processing of the component NTFS. Performing a manipulation results in access control. This vulnerability is known as CVE-2019-1170. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in Microsoft Windows 10 1809/10 1903/Server 1903/Server 2019 (Operating System). This affects an unknown code block of the component NTFS. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system. To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system. The security update addresses the vulnerability by preventing sandboxed processes from creating reparse points targeting inaccessible files.

The weakness was published 08/13/2019 as confirmed security update guide (Website). It is possible to read the advisory at portal.msrc.microsoft.com. The public release has been coordinated with Microsoft. This vulnerability is uniquely identified as CVE-2019-1170 since 11/26/2018. It is possible to initiate the attack remotely. The requirement for exploitation is a authentication. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK. The advisory points out:

An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47306). Similar entries are available at VDB-139939, VDB-139938, VDB-139937 and VDB-139936. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 10 1809
• 10 1903
• Server 1903
• Server 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion