PT-2019-3196 · Microsoft · Windows

Published 2019-09-10 · Updated 2026-02-06 · CVE-2019-1215

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is related to a driver vulnerability in the ws2ifsl.sys (Winsock) component of the Windows operating system, which is associated with errors in processing objects in memory. Exploitation of this issue may allow an attacker to execute arbitrary code in the target system with administrator privileges using a specially crafted application. This is an elevation-of-privilege vulnerability that allows attackers to affect the system.

Recommendations For Microsoft Windows versions prior to the fixed version, apply the patches from the security bulletin to fix the vulnerability. As a temporary workaround, consider restricting access to the ws2ifsl.sys driver until a patch is available. Avoid using applications that may trigger the exploitation of this vulnerability until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Buffer Overflow

Improper Privilege Management

Weakness Enumeration

CWE-119

CWE-269

Related Identifiers

BDU:2019-03185

CVE-2019-1215

Affected Products

Windows

References · 18

• 🔥 https://github.com/bluefrostsecurity/CVE-2019-1215 · Exploit
• 🔥 https://exploit-db.com/exploits/47935 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1215 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1215 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1215 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2019-1215 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/630367 · Security Note
• https://bdu.fstec.ru/vul/2019-03185 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1215 · Vendor Advisory
• https://t.me/github_repos/3900 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1215 · Note
• https://t.me/cvenotify/110402 · Telegram Post
• https://t.me/defcon_news/34980 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://t.me/sysadm_in_channel/1081 · Telegram Post