The remote Windows host is missing security update 4524570. It is, therefore, affected by multiple vulnerabilities :

  - A security feature bypass vulnerability exists when     Windows Netlogon improperly handles a secure     communications channel. An attacker who successfully     exploited the vulnerability could downgrade aspects of     the connection allowing for further modification of the     transmission.  (CVE-2019-1424)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-11135)

  - An information disclosure vulnerability exists in the     way Windows Error Reporting (WER) handles objects in     memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2019-1374)

  - A local elevation of privilege vulnerability exists in     how splwow64.exe handles certain calls. An attacker who     successfully exploited the vulnerability could elevate     privileges on an affected system from low-integrity to     medium-integrity. This vulnerability by itself does not     allow arbitrary code execution; however, it could allow     arbitrary code to be run if the attacker uses it in     combination with another vulnerability (such as a remote     code execution vulnerability or another elevation of     privilege vulnerability) that is capable of leveraging     the elevated privileges when code execution is     attempted. The security update addresses the     vulnerability by ensuring splwow64.exe properly handles     these calls.. (CVE-2019-1380)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1436, CVE-2019-1440)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2019-1429)

  - A remote code execution vulnerability exists when     Windows Media Foundation improperly parses specially     crafted QuickTime media files. An attacker who     successfully exploited this vulnerability could gain the     same user rights as the local user. Users whose accounts     are configured to have fewer user rights on the system     could be less impacted than users who operate with     administrative user rights.  (CVE-2019-1430)

  - A security feature bypass vulnerability exists where a     NETLOGON message is able to obtain the session key and     sign messages.  (CVE-2019-1384)

  - An elevation of privilege vulnerability exists when the     Windows User Profile Service (ProfSvc) improperly     handles symlinks. An attacker who successfully exploited     this vulnerability could delete files and folders in an     elevated context.  (CVE-2019-1454)

  - An information vulnerability exists when Windows Modules     Installer Service improperly discloses file information.
    Successful exploitation of the vulnerability could allow     the attacker to read the contents of a log file on disk.
    (CVE-2019-1418)

  - An elevation of privilege vulnerability exists in the     Windows Certificate Dialog when it does not properly     enforce user privileges. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context. An attacker could then install     programs; view, change or delete data.  (CVE-2019-1388)

  - An information disclosure vulnerability exists when the     Windows TCP/IP stack improperly handles IPv6 flowlabel     filled in packets. An attacker who successfully     exploited this vulnerability could obtain information to     further compromise the users system.  (CVE-2019-1324)

  - A denial of service vulnerability exists when Windows     improperly handles objects in memory. An attacker who     successfully exploited the vulnerability could cause a     target system to stop responding.  (CVE-2018-12207,     CVE-2019-1391)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2019-1393, CVE-2019-1394,     CVE-2019-1395, CVE-2019-1396, CVE-2019-1408)

  - An elevation of privilege vulnerability exists in     Windows Installer because of the way Windows Installer     handles certain filesystem operations.  (CVE-2019-1415)

  - A remote code execution vulnerability exists when     Windows Hyper-V on a host server fails to properly     validate input from an authenticated user on a guest     operating system.  (CVE-2019-1397, CVE-2019-1398)

  - A remote code execution vulnerability exists when     Windows Hyper-V Network Switch on a host server fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2019-0719, CVE-2019-0721)

  - An information disclosure vulnerability exists when     DirectWrite improperly discloses the contents of its     memory. An attacker who successfully exploited the     vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how DirectWrite handles objects in memory.
    (CVE-2019-1411)

  - An information disclosure vulnerability exists when the     Windows Servicing Stack allows access to unprivileged     file locations. An attacker who successfully exploited     the vulnerability could potentially access unauthorized     files.  (CVE-2019-1381)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-1390)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-1439)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-1406)

  - An elevation of privilege vulnerability exists when the     Windows Universal Plug and Play (UPnP) service     improperly allows COM object creation. An attacker who     successfully exploited this vulnerability could run     arbitrary code with elevated system privileges. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights.  (CVE-2019-1405)

  - An elevation of privilege vulnerability exists in the     way that the StartTileData.dll handles file creation in     protected locations. An attacker who successfully     exploited the vulnerability could execute code with     elevated permissions.  (CVE-2019-1423)

  - A denial of service vulnerability exists when Microsoft     Hyper-V Network Switch on a host server fails to     properly validate input from a privileged user on a     guest operating system. An attacker who successfully     exploited the vulnerability could cause the host server     to crash.  (CVE-2019-0712, CVE-2019-1309, CVE-2019-1310)

  - A remote code execution vulnerability exists in     Microsoft Windows when the Windows Adobe Type Manager     Library improperly handles specially crafted OpenType     fonts. For all systems except Windows 10, an attacker     who successfully exploited the vulnerability could     execute code remotely. For systems running Windows 10,     an attacker who successfully exploited the vulnerability     could execute code in an AppContainer sandbox context     with limited privileges and capabilities. An attacker     could then install programs; view, change, or delete     data; or create new accounts with full user rights.
    There are multiple ways an attacker could exploit the     vulnerability, such as by either convincing a user to     open a specially crafted document, or by convincing a     user to visit a webpage that contains specially crafted     embedded OpenType fonts. The update addresses the     vulnerability by correcting how the Windows Adobe Type     Manager Library handles OpenType fonts. (CVE-2019-1419,     CVE-2019-1456)

  - A denial of service vulnerability exists when Microsoft     Hyper-V on a host server fails to properly validate     input from a privileged user on a guest operating     system.  (CVE-2019-1399)

  - An elevation of privilege vulnerability exists when the     Windows Data Sharing Service improperly handles file     operations. An attacker who successfully exploited this     vulnerability could run processes in an elevated     context. An attacker could exploit this vulnerability by     running a specially crafted application on the victim     system. The update addresses the vulnerability by     correcting the way the Windows Data Sharing Service     handles file operations. (CVE-2019-1417)

  - An elevation of privilege vulnerability exists when     ActiveX Installer service may allow access to files     without proper authentication. An attacker who     successfully exploited the vulnerability could     potentially access unauthorized files.  (CVE-2019-1382)

  - An information disclosure vulnerability exists when the     Windows Remote Procedure Call (RPC) runtime improperly     initializes objects in memory. An attacker who     successfully exploited this vulnerability could obtain     information to further compromise the users system.
    (CVE-2019-1409)

  - An elevation of privilege vulnerability exists when the     Windows Graphics Component improperly handles objects in     memory. An attacker who successfully exploited this     vulnerability could run processes in an elevated     context.  (CVE-2019-1433, CVE-2019-1435, CVE-2019-1437,     CVE-2019-1438)

  - An elevation of privilege vulnerability exists in the     way that the dssvc.dll handles file creation allowing     for a file overwrite or creation in a secured location.
    An attacker who successfully exploited the vulnerability     could execute code with elevated permissions.
    (CVE-2019-1420)

  - An elevation of privilege vulnerability exists due to a     race condition in Windows Subsystem for Linux. An     attacker who successfully exploited the vulnerability     could execute code with elevated permissions.
    (CVE-2019-1416)

  - An elevation of privilege vulnerability exists in the     way that the iphlpsvc.dll handles file creation allowing     for a file overwrite. An attacker who successfully     exploited the vulnerability could execute code with     elevated permissions.  (CVE-2019-1422)

  - An elevation of privilege vulnerability exists when the     Windows AppX Deployment Extensions improperly performs     privilege management, resulting in access to system     files.  (CVE-2019-1385)

Detections

Analytics

KB4524570: Windows 10 Version 1903 and Windows 10 Version 1909 November 2019 Security Update

critical Nessus Plugin ID 130902

Version 1.19

Version 1.18

Version 1.19 Apr 8, 2023, 4:08 PM CISA reference Plugin Feed: 202304081608
Version 1.18 Mar 2, 2023, 2:01 PM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202303021401