Sign-up

ID

VAR-201907-1382


CVE

CVE-2019-1167


TITLE

PowerShell Core of Windows Defender Application Control Vulnerabilities that bypass security functions

Trust: 0.8

sources: JVNDB: JVNDB-2019-006787

DESCRIPTION

A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control Security Feature Bypass Vulnerability'. A local attacker can leverage this issue to bypass certain security restrictions and perform unauthorized actions. PowerShell Core 6.1, and 6.2 are vulnerable

Trust: 1.89

sources: NVD: CVE-2019-1167 // JVNDB: JVNDB-2019-006787 // BID: 109267

AFFECTED PRODUCTS

vendor:microsoftmodel:powershell corescope:eqversion:6.2

Trust: 2.1

vendor:microsoftmodel:powershell corescope:eqversion:6.1

Trust: 2.1

vendor:microsoftmodel:powershell corescope:neversion:6.2.2

Trust: 0.3

vendor:microsoftmodel:powershell corescope:neversion:6.1.5

Trust: 0.3

sources: BID: 109267 // JVNDB: JVNDB-2019-006787 // NVD: CVE-2019-1167

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-1167
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-1167
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201907-963
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2019-1167
severity: LOW
baseScore: 1.9
vectorString: AV:L/AC:M/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.4
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2019-1167
baseSeverity: MEDIUM
baseScore: 4.1
vectorString: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 0.5
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: JVNDB: JVNDB-2019-006787 // CNNVD: CNNVD-201907-963 // NVD: CVE-2019-1167

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-254

Trust: 0.8

sources: JVNDB: JVNDB-2019-006787 // NVD: CVE-2019-1167

THREAT TYPE

local

Trust: 0.9

sources: BID: 109267 // CNNVD: CNNVD-201907-963

TYPE

security feature problem

Trust: 0.6

sources: CNNVD: CNNVD-201907-963

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-006787

PATCH
title:CVE-2019-1167 | Windows Defender Application Control Security Feature Bypass Vulnerabilityurl:https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1167
Trust: 0.8
title:CVE-2019-1167 | Windows Defender アプリケーション制御のセキュリティ機能のバイパスの脆弱性url:https://portal.msrc.microsoft.com/ja-jp/security-guidance/advisory/CVE-2019-1167
Trust: 0.8
title:Microsoft Windows Defender Application Control Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=95283
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-006787 // 
            
            
            
            CNNVD: CNNVD-201907-963

EXTERNAL IDS
db:NVDid:CVE-2019-1167
Trust: 2.7
db:BIDid:109267
Trust: 0.9
db:JVNDBid:JVNDB-2019-006787
Trust: 0.8
db:CNNVDid:CNNVD-201907-963
Trust: 0.6
sources:
            
            
            BID: 109267 // 
            
            
            
            JVNDB: JVNDB-2019-006787 // 
            
            
            
            CNNVD: CNNVD-201907-963 // 
            
            
            
            NVD: CVE-2019-1167

REFERENCES
url:https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2019-1167
Trust: 1.9
url:https://nvd.nist.gov/vuln/detail/cve-2019-1167
Trust: 1.4
url:https://github.com/powershell/powershell/security/advisories/ghsa-5frh-8cmj-gc59
Trust: 0.9
url:http://www.microsoft.com/windows/default.mspx
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1167
Trust: 0.8
url:https://vigilance.fr/vulnerability/microsoft-windows-powershell-core-privilege-escalation-via-wdac-29800
Trust: 0.6
url:https://www.securityfocus.com/bid/109267
Trust: 0.6
url:https://portal.msrc.microsoft.com/zh-cn/security-guidance/advisory/cve-2019-1167
Trust: 0.6
sources:
            
            
            BID: 109267 // 
            
            
            
            JVNDB: JVNDB-2019-006787 // 
            
            
            
            CNNVD: CNNVD-201907-963 // 
            
            
            
            NVD: CVE-2019-1167

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 109267

SOURCES
db:BIDid:109267
db:JVNDBid:JVNDB-2019-006787
db:CNNVDid:CNNVD-201907-963
db:NVDid:CVE-2019-1167

LAST UPDATE DATE
2024-08-14T14:32:36.015000+00:00

SOURCES UPDATE DATE
db:BIDid:109267date:2019-07-16T00:00:00
db:JVNDBid:JVNDB-2019-006787date:2019-07-26T00:00:00
db:CNNVDid:CNNVD-201907-963date:2020-08-25T00:00:00
db:NVDid:CVE-2019-1167date:2020-08-24T17:37:01.140

SOURCES RELEASE DATE
db:BIDid:109267date:2019-07-16T00:00:00
db:JVNDBid:JVNDB-2019-006787date:2019-07-26T00:00:00
db:CNNVDid:CNNVD-201907-963date:2019-07-16T00:00:00
db:NVDid:CVE-2019-1167date:2019-07-19T15:15:12.783