An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Privilege Vulnerability'.

The remote Windows host is missing security update 4530692 or cumulative update 4530734. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Microsoft Windows OLE fails to properly validate user     input. An attacker could exploit the vulnerability to     execute malicious code.  (CVE-2019-1484)

  - A denial of service vulnerability exists in Remote     Desktop Protocol (RDP) when an attacker connects to the     target system using RDP and sends specially crafted     requests. An attacker who successfully exploited this     vulnerability could cause the RDP service on the target     system to stop responding.  (CVE-2019-1453)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1474)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2019-1468)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-1465, CVE-2019-1466, CVE-2019-1467)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1469)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2019-1458)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2019-1470)

  - A security feature bypass vulnerability exists when     Microsoft Defender improperly handles specific buffers.
    An attacker could exploit the vulnerability to trigger     warnings and false positives when no threat is present.
    (CVE-2019-1488)

  - An elevation of privilege vulnerability exists when     Windows improperly handles COM object creation. An     attacker who successfully exploited the vulnerability     could run arbitrary code with elevated privileges.
    (CVE-2019-1478)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-1485)

The remote Windows host is missing security update 4530719 or cumulative update 4530695. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Microsoft Windows OLE fails to properly validate user     input. An attacker could exploit the vulnerability to     execute malicious code.  (CVE-2019-1484)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1474)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2019-1468)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-1465, CVE-2019-1466, CVE-2019-1467)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1469)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2019-1458)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2019-1470)

  - A security feature bypass vulnerability exists when     Microsoft Defender improperly handles specific buffers.
    An attacker could exploit the vulnerability to trigger     warnings and false positives when no threat is present.
    (CVE-2019-1488)

  - An elevation of privilege vulnerability exists when     Windows improperly handles COM object creation. An     attacker who successfully exploited the vulnerability     could run arbitrary code with elevated privileges.
    (CVE-2019-1478)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-1485)

ID	Name	Product	Family	Severity
131934	KB4530692: Windows 7 and Windows Server 2008 R2 December 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
131929	KB4530719: Windows Server 2008 December 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2019-1478

high

Tenable Plugins

high

high