PT-2019-2474 · Microsoft · Windows

Eyal Karni + 6 · Publicado 2019-05-21 · Atualizado 2026-03-10 · CVE-2019-1040

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows (affected versions not specified)

Description A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. This vulnerability allows attackers to affect the system. The issue is related to the NTLM MIC protection mechanism, which can be exploited by a remote attacker to downgrade the security features of the NTLM mechanism. The vulnerability can be used to relay NetNTLMv1 authentication to LDAP, and it has been exploited in real-world attacks, including the RBCD attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

BDU:2019-02252

CVE-2019-1040

Produtos afetados

Windows

Referências · 38

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/http/file_sharing_wizard_seh.rb · Exploit
• 🔥 https://github.com/fox-it/cve-2019-1040-scanner · Exploit
• 🔥 https://github.com/Ridter/CVE-2019-1040 · Exploit
• 🔥 https://github.com/QAX-A-Team/dcpwn · Exploit
• 🔥 https://github.com/Ridter/CVE-2019-1040-dcpwn · Exploit
• 🔥 https://github.com/lazaars/UltraRealy_with_CVE-2019-1040 · Exploit
• 🔥❌ https://github.com/wzxmt/CVE-2019-1040 · Exploit, Deleted
• https://github.com/JonyFilc/PrintSpoofer-ReflectiveDLL · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1040 · Aviso do Fabricante
• https://t.me/defcon_news/16277 · Publicação no Telegram
• https://twitter.com/n00py1/status/1702159465284563405 · Publicação no Twitter
• https://t.me/ckure/2089 · Publicação no Telegram
• https://t.me/defcon_news/16353 · Publicação no Telegram
• https://t.me/cybersecuritytechnologies/283 · Publicação no Telegram
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2019-1040 · Aviso do Fabricante