PT-2020-3903 · Microsoft · Windows

Zhiniang Peng · Published 2020-09-08 · Updated 2023-12-31 · CVE-2020-1590

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified)

Description: The issue is related to an elevation of privilege vulnerability in the Connected User Experiences and Telemetry Service of Windows operating systems. This vulnerability is caused by improper handling of file operations, which can lead to a buffer overflow in memory. An attacker who successfully exploits this vulnerability could gain elevated privileges on the victim system by running a specially crafted application. The attacker would first need to gain execution on the victim system.

Recommendations: To resolve the issue, apply the security update that corrects how the Connected User Experiences and Telemetry Service handles file operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2020-04296

CVE-2020-1590

Affected Products

Windows

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1590 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-1590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1590 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1590 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1590 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04296 · Security Note