PT-2019-3648 · Microsoft · Azure App Service

Ronen Shustin · Publicado 2019-10-08 · Atualizado 2020-08-24 · CVE-2019-1372

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azure App Service (affected versions not specified)

Description A remote code execution issue exists due to improper memory object handling in Azure App Service on Azure Stack. This allows an attacker to execute code in the context of NT AUTHORITYSYSTEM, potentially escaping the sandbox. The issue is addressed by sanitizing user inputs.

Recommendations For Azure App Service, ensure that the security update is applied to address the vulnerability by sanitizing user inputs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2019-03863

CVE-2019-1372

Produtos afetados

Azure App Service

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-1372 · Nota de Segurança
• https://research.checkpoint.com/2020/remote-cloud-execution-critical-vulnerabilities-in-azure-cloud-infrastructure-part-ii · Nota
• https://osv.dev/vulnerability/CVE-2019-1372 · Aviso do Fabricante
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1372 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-03863 · Nota de Segurança