CVE-2019-1163Improper Validation of Integrity Check Value in Microsoft Windows 10 Version 1507

Severity
5.5MEDIUMNVD
EPSS
2.2%
top 15.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedAug 14
Latest updateMay 24

Description

A security feature bypass exists when Windows incorrectly validates CAB file signatures. An attacker who successfully exploited this vulnerability could inject code into a CAB file without invalidating the file's signature. To exploit the vulnerability, an attacker could modify a signed CAB file and inject malicious code. The attacker could then convince a target user to execute the file. The update addresses the vulnerability by correcting how Windows validates file signatures.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages14 packages

CVEListV5microsoft/windows_server_201610.0.0publication
CVEListV5microsoft/windows_server_201910.0.0publication
CVEListV5microsoft/windows_10_version_150710.0.0publication
CVEListV5microsoft/windows_10_version_160710.0.0publication
CVEListV5microsoft/windows_10_version_170310.0.0publication

Patches

🔴Vulnerability Details

2
GHSA
GHSA-c3q8-2rfg-gpqv: A security feature bypass exists when Windows incorrectly validates CAB file signatures, aka 'Windows File Signature Security Feature Bypass Vulnerabi2022-05-24
CVEList
Windows File Signature Security Feature Bypass Vulnerability2019-08-14

📋Vendor Advisories

1
Microsoft
Windows File Signature Security Feature Bypass Vulnerability2019-08-13

💬Community

1
Bugzilla
CVE-2019-2697 Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D)2019-04-29
CVE-2019-1163 — Microsoft vulnerability | cvebase