Sign-up

ID

VAR-201911-1095


CVE

CVE-2019-1392


TITLE

plural Microsoft Windows Vulnerability with elevated privileges in products

Trust: 0.8

sources: JVNDB: JVNDB-2019-011780

DESCRIPTION

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. SCALANCE S firewall is used to protect trusted industrial networks from untrusted networks. There is a denial of service vulnerability in the SIEMENS SCALAN CES-600 family. An attacker could use the vulnerability to send packets to the affected device's 443 / tcp port, resulting in a denial of service situation

Trust: 2.16

sources: NVD: CVE-2019-1392 // JVNDB: JVNDB-2019-011780 // CNVD: CNVD-2020-04717

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-04717

AFFECTED PRODUCTS

vendor:microsoftmodel:windows server 2012scope:eqversion:r2

Trust: 1.8

vendor:microsoftmodel:windows 10scope:eqversion: -

Trust: 1.0

vendor:microsoftmodel:windows server 2012scope:eqversion: -

Trust: 1.0

vendor:microsoftmodel:windows 8.1scope:eqversion: -

Trust: 1.0

vendor:microsoftmodel:windows rt 8.1scope:eqversion: -

Trust: 1.0

vendor:microsoftmodel:windows 10scope:eqversion:for 32-bit systems

Trust: 0.8

vendor:microsoftmodel:windows 10scope:eqversion:for x64-based systems

Trust: 0.8

vendor:microsoftmodel:windows 8.1scope:eqversion:for 32-bit systems

Trust: 0.8

vendor:microsoftmodel:windows 8.1scope:eqversion:for x64-based systems

Trust: 0.8

vendor:microsoftmodel:windows rt 8.1scope: - version: -

Trust: 0.8

vendor:microsoftmodel:windows server 2012scope:eqversion:none

Trust: 0.8

vendor:microsoftmodel:windows server 2012scope:eqversion:(server core installation)

Trust: 0.8

vendor:microsoftmodel:windows server 2012scope:eqversion:r2 (server core installation)

Trust: 0.8

vendor:siemensmodel:scalance s627-2mscope:gteversion:v3.0

Trust: 0.6

vendor:siemensmodel:scalance s623scope:gteversion:v3.0

Trust: 0.6

vendor:siemensmodel:scalance s612scope:gteversion:v3.0

Trust: 0.6

vendor:siemensmodel:scalance s602scope:gteversion:v3.0

Trust: 0.6

sources: CNVD: CNVD-2020-04717 // JVNDB: JVNDB-2019-011780 // NVD: CVE-2019-1392

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-1392
value: HIGH

Trust: 1.0

NVD: CVE-2019-1392
value: HIGH

Trust: 0.8

CNVD: CNVD-2020-04717
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201911-566
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2019-1392
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2020-04717
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2019-1392
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2019-1392
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-04717 // JVNDB: JVNDB-2019-011780 // CNNVD: CNNVD-201911-566 // NVD: CVE-2019-1392

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-269

Trust: 0.8

sources: JVNDB: JVNDB-2019-011780 // NVD: CVE-2019-1392

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201911-566

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201911-566

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-011780

PATCH
title:CVE-2019-1392 | Windows Kernel Elevation of Privilege Vulnerabilityurl:https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1392
Trust: 0.8
title:CVE-2019-1392 | Windows カーネルの特権の昇格の脆弱性url:https://portal.msrc.microsoft.com/ja-jp/security-guidance/advisory/CVE-2019-1392
Trust: 0.8
title:Patch for SIEMENS SCALAN CES-600 family denial of service vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/200135
Trust: 0.6
title:Microsoft Windows Kernel Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=102904
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-04717 // 
            
            
            
            JVNDB: JVNDB-2019-011780 // 
            
            
            
            CNNVD: CNNVD-201911-566

EXTERNAL IDS
db:NVDid:CVE-2019-1392
Trust: 3.0
db:JVNDBid:JVNDB-2019-011780
Trust: 0.8
db:SIEMENSid:SSA-591405
Trust: 0.6
db:CNVDid:CNVD-2020-04717
Trust: 0.6
db:CNNVDid:CNNVD-201911-566
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-04717 // 
            
            
            
            JVNDB: JVNDB-2019-011780 // 
            
            
            
            CNNVD: CNNVD-201911-566 // 
            
            
            
            NVD: CVE-2019-1392

REFERENCES
url:https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2019-1392
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2019-1392
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1392
Trust: 0.8
url:https://www.ipa.go.jp/security/ciadr/vul/20191113-ms.html
Trust: 0.8
url:http://www.jpcert.or.jp/at/2019/at190042.html
Trust: 0.8
url:https://cert-portal.siemens.com/productcert/pdf/ssa-591405.pdf
Trust: 0.6
url:https://portal.msrc.microsoft.com/zh-cn/security-guidance/advisory/cve-2019-1392
Trust: 0.6
url:https://vigilance.fr/vulnerability/microsoft-windows-vulnerabilities-of-november-2019-30842
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-04717 // 
            
            
            
            JVNDB: JVNDB-2019-011780 // 
            
            
            
            CNNVD: CNNVD-201911-566 // 
            
            
            
            NVD: CVE-2019-1392

SOURCES
db:CNVDid:CNVD-2020-04717
db:JVNDBid:JVNDB-2019-011780
db:CNNVDid:CNNVD-201911-566
db:NVDid:CVE-2019-1392

LAST UPDATE DATE
2024-08-14T13:12:54.938000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-04717date:2020-02-12T00:00:00
db:JVNDBid:JVNDB-2019-011780date:2019-11-18T00:00:00
db:CNNVDid:CNNVD-201911-566date:2020-08-25T00:00:00
db:NVDid:CVE-2019-1392date:2020-08-24T17:37:01.140

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-04717date:2020-02-12T00:00:00
db:JVNDBid:JVNDB-2019-011780date:2019-11-18T00:00:00
db:CNNVDid:CNNVD-201911-566date:2019-11-12T00:00:00
db:NVDid:CVE-2019-1392date:2019-11-12T19:15:12.833