What is CVE-2019-1372?

CVE-2019-1372 is a security advisory published by Microsoft Security Response Center (MSRC) with Critical severity. Azure Stack Remote Code Execution Vulnerability

Which CVE IDs does CVE-2019-1372 cover?

CVE-2019-1372 covers the following CVE IDs: CVE-2019-1372. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2019-1372?

CVE-2019-1372 affects 2 products, including: Azure App Service on Azure Stack; Windows Azure Pack Web Sites V2.

CVE-2019-1372Critical

Azure Stack Remote Code Execution Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

October 8, 2019

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2019-1372 →

📋 Description

A remote code execution vulnerability exists when Azure Stack fails to check the length of a buffer prior to copying memory to it. An attacker who successfully exploited this vulnerability could allow an unprivileged function run by the user to execute code in the context of NT AUTHORITY\system thereby escaping the Sandbox. The security update addresses the vulnerability by ensuring that Azure Stack sanitizes user inputs.

🎯 Affected products2

Azure App Service on Azure Stack
Windows Azure Pack Web Sites V2

✅ Remediation

KBRelease Notes (Security Update) KB4524964 (Security Update)

🔗 References (2)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1372
patchhttps://www.microsoft.com/en-us/download/details.aspx?id=100854