PT-2020-3670 · Microsoft · Windows+1

Zhiniang Peng · Published 2020-08-11 · Updated 2024-01-19 · CVE-2020-1474

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows (affected versions not specified)

Description The issue is related to a buffer overflow in memory, allowing an attacker to disclose protected information using a specially crafted application. An authenticated attacker could exploit this by connecting an imaging device to the system and running the malicious application, potentially obtaining information to further compromise the system.

Recommendations To resolve the issue, apply the security update that corrects how the Windows Image Acquisition (WIA) Service handles objects in memory. As a temporary workaround, consider restricting access to the WIA Service to minimize the risk of exploitation. Avoid using the WIA Service with untrusted imaging devices until the issue is resolved.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2020-04018

CVE-2020-1474

Affected Products

Windows

Windows Image Acquisition (Wia) Service

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-1474 · Security Note
• https://bdu.fstec.ru/vul/2020-04018 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-1474 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1474 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1474 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1474 · Security Note
• https://cybersecurity-help.cz/vdb/SB2020081227 · Note