An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0682, CVE-2019-0692, CVE-2019-0693, CVE-2019-0694.

The remote Windows host is missing security update 4489899.
It is, therefore, affected by multiple vulnerabilities :

  - A memory corruption vulnerability exists in the Windows     DHCP client when an attacker sends specially crafted     DHCP responses to a client. An attacker who successfully     exploited the vulnerability could run arbitrary code on     the client machine.  (CVE-2019-0697, CVE-2019-0698,     CVE-2019-0726)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0617)

  - A security feature bypass vulnerability exists when     Internet Explorer fails to validate the correct Security     Zone of requests for specific URLs. This could allow an     attacker to cause a user to access a URL in a less     restricted Internet Security Zone than intended.
    (CVE-2019-0761)

  - A remote code execution vulnerability exists in the way     that Microsoft browsers access objects in memory. The     vulnerability could corrupt memory in a way that could     allow an attacker to execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-0780)

  - A remote code execution vulnerability exists in the way     the scripting engine handles objects in memory in     Microsoft browsers. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2019-0609)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0702, CVE-2019-0755, CVE-2019-0775)

  - An information disclosure vulnerability exists in the     way that the Windows SMB Server handles certain     requests. An authenticated attacker who successfully     exploited this vulnerability could craft a special     packet, which could lead to information disclosure from     the server.  (CVE-2019-0703, CVE-2019-0704,     CVE-2019-0821)

  - An information disclosure vulnerability exists when the     Windows Print Spooler does not properly handle objects     in memory. An attacker who successfully exploited this     vulnerability could use the information to further     exploit the victim system.  (CVE-2019-0759)

  - An information disclosure vulnerability exists when the     Windows kernel fails to properly initialize a memory     address. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2019-0782)

  - A denial of service vulnerability exists when Microsoft     Hyper-V on a host server fails to properly validate     input from a privileged user on a guest operating     system.  (CVE-2019-0695, CVE-2019-0701)

  - A security feature bypass vulnerability exists when     Click2Play protection in Microsoft Edge improperly     handles flash objects. By itself, this bypass     vulnerability does not allow arbitrary code execution.
    However, an attacker could use the bypass vulnerability     in conjunction with another vulnerability, such as a     remote code execution vulnerability, to run arbitrary     code on a target system.  (CVE-2019-0612)

  - A security feature bypass vulnerability exists when     Microsoft browsers improperly handle requests of     different origins. The vulnerability allows Microsoft     browsers to bypass Same-Site cookie restrictions, and to     allow requests that should otherwise be ignored. An     attacker who successfully exploited the vulnerability     could force the browser to send data that would     otherwise be restricted.  (CVE-2019-0762)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2019-0690)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2019-0797)

  - A denial of service vulnerability exists when Windows     improperly handles objects in memory. An attacker who     successfully exploited the vulnerability could cause a     target system to stop responding.  (CVE-2019-0754)

  - A security feature bypass vulnerability exists when     Internet Explorer VBScript execution policy does not     properly restrict VBScript under specific conditions,     and to allow requests that should otherwise be ignored.
    An attacker who successfully exploited the vulnerability     could force the browser to send data that would     otherwise be restricted.  (CVE-2019-0768)

  - An elevation of privilege vulnerability exists when     Microsoft Edge does not properly enforce cross-domain     policies, which could allow an attacker to access     information from one domain and inject it into another     domain.  (CVE-2019-0678)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2019-0680, CVE-2019-0783)

  - A remote code execution vulnerability exists in the way     that the ActiveX Data objects (ADO) handles objects in     memory. The vulnerability could corrupt memory in such a     way that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-0784)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0776)

  - An elevation of privilege vulnerability exists in     Windows AppX Deployment Server that allows file creation     in arbitrary locations.  (CVE-2019-0766)

  - An elevation of privilege vulnerability exists when the     Windows kernel fails to properly handle objects in     memory. An attacker who successfully exploited this     vulnerability could run arbitrary code in kernel mode.
    An attacker could then install programs; view, change,     or delete data; or create new accounts with full user     rights.  (CVE-2019-0696)

  - A remote code execution vulnerability exists in the way     that Windows Deployment Services TFTP Server handles     objects in memory. An attacker who successfully     exploited the vulnerability could execute arbitrary code     with elevated permissions on a target system.
    (CVE-2019-0603)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-0614, CVE-2019-0774)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2019-0767)

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-0763)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2019-0592, CVE-2019-0611,     CVE-2019-0746)

  - An elevation of privilege vulnerability exists due to an     integer overflow in Windows Subsystem for Linux. An     attacker who successfully exploited the vulnerability     could execute code with elevated permissions.
    (CVE-2019-0682, CVE-2019-0689, CVE-2019-0692,     CVE-2019-0693, CVE-2019-0694)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Microsoft Edge. The vulnerability could corrupt memory     in such a way that an attacker could execute arbitrary     code in the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-0769,     CVE-2019-0771, CVE-2019-0773)

  - A remote code execution vulnerability exists when the     Microsoft XML Core Services MSXML parser processes user     input. An attacker who successfully exploited the     vulnerability could run malicious code remotely to take     control of the users system.  (CVE-2019-0756)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-0665, CVE-2019-0666,     CVE-2019-0667, CVE-2019-0772)

  - A remote code execution vulnerability exists in the way     that the ChakraCore scripting engine handles objects in     memory. The vulnerability could corrupt memory in such a     way that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-0639)

  - A remote code execution vulnerability exists in the way     that comctl32.dll handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-0765)

The remote Windows host is missing security update 4489886.
It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists when the     Windows kernel fails to properly handle objects in     memory. An attacker who successfully exploited this     vulnerability could run arbitrary code in kernel mode.
    An attacker could then install programs; view, change,     or delete data; or create new accounts with full user     rights.  (CVE-2019-0696)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2019-0797)

  - A denial of service vulnerability exists when Windows     improperly handles objects in memory. An attacker who     successfully exploited the vulnerability could cause a     target system to stop responding.  (CVE-2019-0754)

  - An information disclosure vulnerability exists in the     way that the Windows SMB Server handles certain     requests. An authenticated attacker who successfully     exploited this vulnerability could craft a special     packet, which could lead to information disclosure from     the server.  (CVE-2019-0703, CVE-2019-0704,     CVE-2019-0821)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-0614, CVE-2019-0774)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2019-0767)

  - A denial of service vulnerability exists when Microsoft     Hyper-V on a host server fails to properly validate     input from a privileged user on a guest operating     system.  (CVE-2019-0695)

  - An information disclosure vulnerability exists when the     Windows kernel fails to properly initialize a memory     address. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2019-0782)

  - An elevation of privilege vulnerability exists due to an     integer overflow in Windows Subsystem for Linux. An     attacker who successfully exploited the vulnerability     could execute code with elevated permissions.
    (CVE-2019-0682, CVE-2019-0689, CVE-2019-0692,     CVE-2019-0693, CVE-2019-0694)

  - An information disclosure vulnerability exists when the     Windows Print Spooler does not properly handle objects     in memory. An attacker who successfully exploited this     vulnerability could use the information to further     exploit the victim system.  (CVE-2019-0759)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0617)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-0772)

  - A remote code execution vulnerability exists in the way     that comctl32.dll handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-0765)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0702, CVE-2019-0755, CVE-2019-0775)

  - A remote code execution vulnerability exists when the     Microsoft XML Core Services MSXML parser processes user     input. An attacker who successfully exploited the     vulnerability could run malicious code remotely to take     control of the users system.  (CVE-2019-0756)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0776)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2019-0690)

  - An elevation of privilege vulnerability exists in     Windows AppX Deployment Server that allows file creation     in arbitrary locations.  (CVE-2019-0766)

  - A remote code execution vulnerability exists in the way     that the ActiveX Data objects (ADO) handles objects in     memory. The vulnerability could corrupt memory in such a     way that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-0784)

The remote Windows host is missing security update 4489868.
It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists when the     Windows kernel fails to properly handle objects in     memory. An attacker who successfully exploited this     vulnerability could run arbitrary code in kernel mode.
    An attacker could then install programs; view, change,     or delete data; or create new accounts with full user     rights.  (CVE-2019-0696)

  - A remote code execution vulnerability exists in the way     that Windows Deployment Services TFTP Server handles     objects in memory. An attacker who successfully     exploited the vulnerability could execute arbitrary code     with elevated permissions on a target system.
    (CVE-2019-0603)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2019-0797)

  - A denial of service vulnerability exists when Windows     improperly handles objects in memory. An attacker who     successfully exploited the vulnerability could cause a     target system to stop responding.  (CVE-2019-0754)

  - An information disclosure vulnerability exists in the     way that the Windows SMB Server handles certain     requests. An authenticated attacker who successfully     exploited this vulnerability could craft a special     packet, which could lead to information disclosure from     the server.  (CVE-2019-0703, CVE-2019-0704,     CVE-2019-0821)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-0614, CVE-2019-0774)

  - An information disclosure vulnerability exists when the     Windows kernel improperly initializes objects in memory.
    (CVE-2019-0767)

  - An information disclosure vulnerability exists when the     Windows kernel fails to properly initialize a memory     address. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2019-0782)

  - An elevation of privilege vulnerability exists due to an     integer overflow in Windows Subsystem for Linux. An     attacker who successfully exploited the vulnerability     could execute code with elevated permissions.
    (CVE-2019-0682, CVE-2019-0689, CVE-2019-0692,     CVE-2019-0693, CVE-2019-0694)

  - An information disclosure vulnerability exists when the     Windows Print Spooler does not properly handle objects     in memory. An attacker who successfully exploited this     vulnerability could use the information to further     exploit the victim system.  (CVE-2019-0759)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0617)

  - A denial of service vulnerability exists when Microsoft     Hyper-V on a host server fails to properly validate     input from a privileged user on a guest operating     system.  (CVE-2019-0695, CVE-2019-0701)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-0772)

  - A remote code execution vulnerability exists in the way     that comctl32.dll handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-0765)

  - A memory corruption vulnerability exists in the Windows     DHCP client when an attacker sends specially crafted     DHCP responses to a client. An attacker who successfully     exploited the vulnerability could run arbitrary code on     the client machine.  (CVE-2019-0697, CVE-2019-0698,     CVE-2019-0726)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0702, CVE-2019-0755, CVE-2019-0775)

  - A remote code execution vulnerability exists when the     Microsoft XML Core Services MSXML parser processes user     input. An attacker who successfully exploited the     vulnerability could run malicious code remotely to take     control of the users system.  (CVE-2019-0756)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0776)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2019-0690)

  - An elevation of privilege vulnerability exists in     Windows AppX Deployment Server that allows file creation     in arbitrary locations.  (CVE-2019-0766)

  - A remote code execution vulnerability exists in the way     that the ActiveX Data objects (ADO) handles objects in     memory. The vulnerability could corrupt memory in such a     way that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-0784)

ID	Name	Product	Family	Severity
122788	KB4489899: Windows 10 Version 1809 and Windows Server 2019 March 2019 Security Update	Nessus	Windows : Microsoft Bulletins	critical
122786	KB4489886: Windows 10 Version 1709 and Windows Server Version 1709 March 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
122779	KB4489868: Windows 10 Version 1803 and Windows Server Version 1803 March 2019 Security Update	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2019-0689

high

Tenable Plugins

critical

high

critical