high8.5Public exploit code
CVE-2019-1019
A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Windows 10.0.17134.648 - HTTP -> SMB NTLM Reflection Leads to Privilege Elevation2019-07-12 · local · windows · Verified
Impact
A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages. To exploit this vulnerability, an attacker could send a specially crafted authentication request. An attacker who successfully exploited this vulnerability could access another machine using the original user privileges. The issue has been addressed by changing how NTLM validates network authentication messages.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Windows 10 | All versions Versions 1607, 1703, 1709, 1803, 1809 |
| Microsoft | Windows 7 | All versions |
| Microsoft | Windows 8.1 | All versions |
| Microsoft | Windows Rt 8.1 | All versions |
| Microsoft | Windows Server 2008 | All versions Version r2 |
| Microsoft | Windows Server 2012 | All versions Version r2 |
| Microsoft | Windows Server 2016 | All versions Versions 1803, 1903 |
| Microsoft | Windows Server 2019 | All versions |