An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Windows Update Client Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1323.

The remote Windows host is missing security update 4519338.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge (HTML-based). The vulnerability     could corrupt memory in such a way that an attacker     could execute arbitrary code in the context of the     current user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user. (CVE-2019-1307, CVE-2019-1308,     CVE-2019-1335)

  - An elevation of privilege vulnerability exists in     Windows AppX Deployment Server that allows file creation     in arbitrary locations.  (CVE-2019-1340)

  - A spoofing vulnerability exists when Microsoft Browsers     does not properly parse HTTP content. An attacker who     successfully exploited this vulnerability could     impersonate a user request by crafting HTTP queries. The     specially crafted website could either spoof content or     serve as a pivot to chain an attack with other     vulnerabilities in web services.  (CVE-2019-0608)

  - A denial of service vulnerability exists when Windows     improperly handles hard links. An attacker who     successfully exploited the vulnerability could cause a     target system to stop responding.  (CVE-2019-1317)

  - A denial of service vulnerability exists when Windows     improperly handles objects in memory. An attacker who     successfully exploited the vulnerability could cause a     target system to stop responding.  (CVE-2019-1343,     CVE-2019-1346, CVE-2019-1347)

  - An elevation of privilege vulnerability exists when     Windows Error Reporting manager improperly handles a     process crash. An attacker who successfully exploited     this vulnerability could delete a targeted file leading     to an elevated status.  (CVE-2019-1342)

  - An elevation of privilege vulnerability exists in the     Microsoft Windows Update Client when it does not     properly handle privileges. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context. An attacker could then install     programs; view, change or delete data.  (CVE-2019-1323,     CVE-2019-1336)

  - An information disclosure vulnerability exists when     Microsoft Edge based on Edge HTML improperly handles     objects in memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the user’s system. To exploit the vulnerability,     in a web-based attack scenario, an attacker could host a     website in an attempt to exploit the vulnerability. In     addition, compromised websites and websites that accept     or host user-provided content could contain specially     crafted content that could exploit the vulnerability.     (CVE-2019-1356)

  - An information disclosure vulnerability exists when the     Windows Hyper-V Network Switch on a host operating     system fails to properly validate input from an     authenticated user on a guest operating system.
    (CVE-2019-1230)

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-1371)

  - An elevation of privilege vulnerability exists in     Microsoft Windows Setup when it does not properly handle     privileges. An attacker who successfully exploited this     vulnerability could run processes in an elevated     context. An attacker could then install programs; view,     change or delete data.  (CVE-2019-1316)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1334, CVE-2019-1345)

  - A spoofing vulnerability exists when Transport Layer     Security (TLS) accesses non- Extended Master Secret     (EMS) sessions. An attacker who successfully exploited     this vulnerability may gain access to unauthorized     information.  (CVE-2019-1318)

  - An elevation of privilege vulnerability exists when     Windows improperly handles authentication requests. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context. An attacker     could exploit this vulnerability by running a specially     crafted application on the victim system. The update     addresses the vulnerability by correcting the way     Windows handles authentication requests. (CVE-2019-1320,     CVE-2019-1322)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-1238, CVE-2019-1239)

  - A remote code execution vulnerability exists in the     Windows Remote Desktop Client when a user connects to a     malicious server. An attacker who successfully exploited     this vulnerability could execute arbitrary code on the     computer of the connecting client. An attacker could     then install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2019-1333)

  - A security feature bypass exists when Windows Secure     Boot improperly restricts access to debugging     functionality. An attacker who successfully exploited     this vulnerability could disclose protected kernel     memory.  (CVE-2019-1368)

  - A tampering vulnerability exists in Microsoft Windows     when a man-in-the-middle attacker is able to     successfully bypass the NTLM MIC (Message Integrity     Check) protection. An attacker who successfully     exploited this vulnerability could gain the ability to     downgrade NTLM security features.  (CVE-2019-1166)

  - An elevation of privilege vulnerability exists in the     Windows redirected drive buffering system (rdbss.sys)     when the operating system improperly handles specific     local calls within Windows 7 for 32-bit systems. When     this vulnerability is exploited within other versions of     Windows it can cause a denial of service, but not an     elevation of privilege.  (CVE-2019-1325)

  - An elevation of privilege vulnerability exists when     Windows Error Reporting manager improperly handles hard     links. An attacker who successfully exploited this     vulnerability could overwrite a targeted file leading to     an elevated status.  (CVE-2019-1315, CVE-2019-1339)

  - An elevation of privilege vulnerability exists when     Microsoft IIS Server fails to check the length of a     buffer prior to copying memory to it. An attacker who     successfully exploited this vulnerability can allow an     unprivileged function ran by the user to execute code in     the context of NT AUTHORITY\system escaping the Sandbox.
    The security update addresses the vulnerability by     correcting how Microsoft IIS Server sanitizes web     requests. (CVE-2019-1365)

  - A spoofing vulnerability exists when Microsoft Browsers     improperly handle browser cookies. An attacker who     successfully exploited this vulnerability could trick a     browser into overwriting a secure cookie with an     insecure cookie. The insecure cookie could serve as a     pivot to chain an attack with other vulnerabilities in     web services.  (CVE-2019-1357)

  - An elevation of privilege vulnerability exists when     Windows CloudStore improperly handles file Discretionary     Access Control List (DACL). An attacker who successfully     exploited this vulnerability could overwrite a targeted     file leading to an elevated status.  (CVE-2019-1321)

  - A remote code execution vulnerability exists when the     Microsoft XML Core Services MSXML parser processes user     input. An attacker who successfully exploited the     vulnerability could run malicious code remotely to take     control of the users system.  (CVE-2019-1060)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-1358, CVE-2019-1359)

  - An information disclosure vulnerability exists in the     way that the Windows Code Integrity Module handles     objects in memory. An attacker who successfully     exploited this vulnerability could obtain information to     further compromise the users system.  (CVE-2019-1344)

  - A remote code execution vulnerability exists when the     Windows Imaging API improperly handles objects in     memory. The vulnerability could corrupt memory in a way     that enables an attacker to execute arbitrary code in     the context of the current user.  (CVE-2019-1311)

  - A denial of service vulnerability exists in Remote     Desktop Protocol (RDP) when an attacker connects to the     target system using RDP and sends specially crafted     requests. An attacker who successfully exploited this     vulnerability could cause the RDP service on the target     system to stop responding.  (CVE-2019-1326)

  - An information disclosure vulnerability exists when     Windows Update Client fails to properly handle objects     in memory. An attacker who successfully exploited the     vulnerability could potentially disclose memory contents     of an elevated process.  (CVE-2019-1337)

  - An elevation of privilege vulnerability exists when     umpo.dll of the Power Service, improperly handles a     Registry Restore Key function. An attacker who     successfully exploited this vulnerability could delete a     targeted registry key leading to an elevated status.
    (CVE-2019-1341)

  - An elevation of privilege vulnerability exists in     Windows Error Reporting (WER) when WER handles and     executes files. The vulnerability could allow elevation     of privilege if an attacker can successfully exploit it.
    An attacker who successfully exploited the vulnerability     could gain greater access to sensitive information and     system functionality.  (CVE-2019-1319)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge (HTML-based). The vulnerability     could corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current user.     An attacker who successfully exploited the vulnerability     could gain the same user rights as the current user. If     the current user is logged on with administrative user     rights, an attacker who successfully exploited the     vulnerability could take control of an affected system.     An attacker could then install programs; view, change,     or delete data; or create new accounts with full user     rights. (CVE-2019-1366)

The remote Windows host is missing security update 4517389.
It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists in     Windows AppX Deployment Server that allows file creation     in arbitrary locations.  (CVE-2019-1340)

  - A spoofing vulnerability exists when Microsoft Browsers     does not properly parse HTTP content. An attacker who     successfully exploited this vulnerability could     impersonate a user request by crafting HTTP queries. The     specially crafted website could either spoof content or     serve as a pivot to chain an attack with other     vulnerabilities in web services.  (CVE-2019-0608)

  - A denial of service vulnerability exists when Windows     improperly handles hard links. An attacker who     successfully exploited the vulnerability could cause a     target system to stop responding.  (CVE-2019-1317)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge (HTML-based). The vulnerability     could corrupt memory in such a way that an attacker     could execute arbitrary code in the context of the     current user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user. (CVE-2019-1307, CVE-2019-1308,     CVE-2019-1335)

  - A denial of service vulnerability exists when Windows     improperly handles objects in memory. An attacker who     successfully exploited the vulnerability could cause a     target system to stop responding.  (CVE-2019-1343,     CVE-2019-1346, CVE-2019-1347)

  - An elevation of privilege vulnerability exists when     Windows Error Reporting manager improperly handles a     process crash. An attacker who successfully exploited     this vulnerability could delete a targeted file leading     to an elevated status.  (CVE-2019-1342)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-1238)

  - An elevation of privilege vulnerability exists in the     Microsoft Windows Update Client when it does not     properly handle privileges. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context. An attacker could then install     programs; view, change or delete data.  (CVE-2019-1323,     CVE-2019-1336)

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-1371)

  - An elevation of privilege vulnerability exists in     Microsoft Windows Setup when it does not properly handle     privileges. An attacker who successfully exploited this     vulnerability could run processes in an elevated     context. An attacker could then install programs; view,     change or delete data.  (CVE-2019-1316)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1334, CVE-2019-1345)

  - A spoofing vulnerability exists when Transport Layer     Security (TLS) accesses non- Extended Master Secret     (EMS) sessions. An attacker who successfully exploited     this vulnerability may gain access to unauthorized     information.  (CVE-2019-1318)

  - An elevation of privilege vulnerability exists when     Windows improperly handles authentication requests. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context. An attacker     could exploit this vulnerability by running a specially     crafted application on the victim system. The update     addresses the vulnerability by correcting the way     Windows handles authentication requests. (CVE-2019-1320,     CVE-2019-1322)

  - A remote code execution vulnerability exists when the     Microsoft XML Core Services MSXML parser processes user     input. An attacker who successfully exploited the     vulnerability could run malicious code remotely to take     control of the users system.  (CVE-2019-1060)

  - A remote code execution vulnerability exists in the     Windows Remote Desktop Client when a user connects to a     malicious server. An attacker who successfully exploited     this vulnerability could execute arbitrary code on the     computer of the connecting client. An attacker could     then install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2019-1333)

  - An information disclosure vulnerability exists when     Microsoft Edge based on Edge HTML improperly handles     objects in memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the user’s system. To exploit the vulnerability,     in a web-based attack scenario, an attacker could host a     website in an attempt to exploit the vulnerability. In     addition, compromised websites and websites that accept     or host user-provided content could contain specially     crafted content that could exploit the vulnerability.     (CVE-2019-1356)

  - A security feature bypass exists when Windows Secure     Boot improperly restricts access to debugging     functionality. An attacker who successfully exploited     this vulnerability could disclose protected kernel     memory.  (CVE-2019-1368)

  - A tampering vulnerability exists in Microsoft Windows     when a man-in-the-middle attacker is able to     successfully bypass the NTLM MIC (Message Integrity     Check) protection. An attacker who successfully     exploited this vulnerability could gain the ability to     downgrade NTLM security features.  (CVE-2019-1166)

  - An elevation of privilege vulnerability exists in the     Windows redirected drive buffering system (rdbss.sys)     when the operating system improperly handles specific     local calls within Windows 7 for 32-bit systems. When     this vulnerability is exploited within other versions of     Windows it can cause a denial of service, but not an     elevation of privilege.  (CVE-2019-1325)

  - An elevation of privilege vulnerability exists when     Windows Error Reporting manager improperly handles hard     links. An attacker who successfully exploited this     vulnerability could overwrite a targeted file leading to     an elevated status.  (CVE-2019-1315, CVE-2019-1339)

  - An elevation of privilege vulnerability exists when     Microsoft IIS Server fails to check the length of a     buffer prior to copying memory to it. An attacker who     successfully exploited this vulnerability can allow an     unprivileged function ran by the user to execute code in     the context of NT AUTHORITY\system escaping the Sandbox.
    The security update addresses the vulnerability by     correcting how Microsoft IIS Server sanitizes web     requests. (CVE-2019-1365)

  - A spoofing vulnerability exists when Microsoft Browsers     improperly handle browser cookies. An attacker who     successfully exploited this vulnerability could trick a     browser into overwriting a secure cookie with an     insecure cookie. The insecure cookie could serve as a     pivot to chain an attack with other vulnerabilities in     web services.  (CVE-2019-1357)

  - An elevation of privilege vulnerability exists when     Windows CloudStore improperly handles file Discretionary     Access Control List (DACL). An attacker who successfully     exploited this vulnerability could overwrite a targeted     file leading to an elevated status.  (CVE-2019-1321)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-1358, CVE-2019-1359)

  - An information disclosure vulnerability exists in the     way that the Windows Code Integrity Module handles     objects in memory. An attacker who successfully     exploited this vulnerability could obtain information to     further compromise the users system.  (CVE-2019-1344)

  - A remote code execution vulnerability exists when the     Windows Imaging API improperly handles objects in     memory. The vulnerability could corrupt memory in a way     that enables an attacker to execute arbitrary code in     the context of the current user.  (CVE-2019-1311)

  - A denial of service vulnerability exists in Remote     Desktop Protocol (RDP) when an attacker connects to the     target system using RDP and sends specially crafted     requests. An attacker who successfully exploited this     vulnerability could cause the RDP service on the target     system to stop responding.  (CVE-2019-1326)

  - An information disclosure vulnerability exists when     Windows Update Client fails to properly handle objects     in memory. An attacker who successfully exploited the     vulnerability could potentially disclose memory contents     of an elevated process.  (CVE-2019-1337)

  - An elevation of privilege vulnerability exists when     umpo.dll of the Power Service, improperly handles a     Registry Restore Key function. An attacker who     successfully exploited this vulnerability could delete a     targeted registry key leading to an elevated status.
    (CVE-2019-1341)

  - An elevation of privilege vulnerability exists in     Windows Error Reporting (WER) when WER handles and     executes files. The vulnerability could allow elevation     of privilege if an attacker can successfully exploit it.
    An attacker who successfully exploited the vulnerability     could gain greater access to sensitive information and     system functionality.  (CVE-2019-1319)     
  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge (HTML-based). The vulnerability     could corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current user.     An attacker who successfully exploited the vulnerability     could gain the same user rights as the current user. If     the current user is logged on with administrative user     rights, an attacker who successfully exploited the     vulnerability could take control of an affected system.     An attacker could then install programs; view, change,     or delete data; or create new accounts with full user     rights. (CVE-2019-1366)

ID	Name	Product	Family	Severity
129717	KB4519338: Windows 10 Version 1809 and Windows Server 2019 October 2019 Security Update	Nessus	Windows : Microsoft Bulletins	critical
129716	KB4517389: Windows 10 Version 1903 October 2019 Security Update	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2019-1336

high

Tenable Plugins

critical

critical