CVE-2019-1287
published 2019-09-11CVE-2019-1287: An elevation of privilege vulnerability exists in the way that the Windows Network Connectivity Assistant handles objects in memory, aka 'Windows Network…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.81%
52.8th percentile
An elevation of privilege vulnerability exists in the way that the Windows Network Connectivity Assistant handles objects in memory, aka 'Windows Network Connectivity Assistant Elevation of Privilege Vulnerability'.
Affected
54 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1903_for_32-bit_systems | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows Network Connectivity Assistant Elevation of Privilege Vulnerability
vendor_msrc·2019-09-10·CVSS 7.8
CVE-2019-1287 [HIGH] Windows Network Connectivity Assistant Elevation of Privilege Vulnerability
Windows Network Connectivity Assistant Elevation of Privilege Vulnerability
Description: An elevation of privilege vulnerability exists in the way that the Windows Network Connectivity Assistant handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.
To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.
The security update addresses the vulnerability by ensuring the Windows Network Connectivity Assistant properly handles objects in memory.
Microsoft Windows: Microsoft Windows
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older
GHSA
GHSA-3r69-rhq3-r35g: An elevation of privilege vulnerability exists in the way that the Windows Network Connectivity Assistant handles objects in memory, aka 'Windows Netw
ghsa_unreviewed·2022-05-24
CVE-2019-1287 [MEDIUM] GHSA-3r69-rhq3-r35g: An elevation of privilege vulnerability exists in the way that the Windows Network Connectivity Assistant handles objects in memory, aka 'Windows Netw
An elevation of privilege vulnerability exists in the way that the Windows Network Connectivity Assistant handles objects in memory, aka 'Windows Network Connectivity Assistant Elevation of Privilege Vulnerability'.
Suricata
ET ATTACK_RESPONSE Possible CVE-2016-1287 Inbound Reverse CLI Shellcode
suricata·2016-05-18·CVSS 9.8
CVE-2016-1287 [CRITICAL] ET ATTACK_RESPONSE Possible CVE-2016-1287 Inbound Reverse CLI Shellcode
ET ATTACK_RESPONSE Possible CVE-2016-1287 Inbound Reverse CLI Shellcode
Rule: alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"ET ATTACK_RESPONSE Possible CVE-2016-1287 Inbound Reverse CLI Shellcode"; flow:to_server; content:"|ff ff ff|tcp/CONNECT/3/"; pcre:"/^(?:\d{1,3}\.){3}\d{1,3}\/\d+\x00$/Ri"; reference:url,raw.githubusercontent.com/exodusintel/disclosures/master/CVE_2016_1287_PoC; classtype:attempted-admin; sid:2022819; rev:1; metadata:created_at 2016_05_18, cve CVE_2016_1287, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
Suricata
ET EXPLOIT CVE-2016-1287 Public Exploit ShellCode
suricata·2016-05-18·CVSS 9.8
CVE-2016-1287 [CRITICAL] ET EXPLOIT CVE-2016-1287 Public Exploit ShellCode
ET EXPLOIT CVE-2016-1287 Public Exploit ShellCode
Rule: alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"ET EXPLOIT CVE-2016-1287 Public Exploit ShellCode"; content:"|60 c7 02 90 67 b9 09 8b 45 f8 8b 40 5c 8b 40 04 8b 40 08 8b 40 04 8b 00 85 c0 74 3b 50 8b 40 08 8b 40 04 8d 98 d8 00 00 00 58 81 3b d0 d4 00 e1 75 e4 83 7b 04 31 74 de 89 d8 2d 00 01 00 00 c7 40 04 03 01 00 00 c7 40 0c d0 00 00 00 c7 80 f8|"; reference:url,github.com/exodusintel/disclosures/blob/master/CVE_2016_1287_PoC; classtype:attempted-admin; sid:2022820; rev:1; metadata:created_at 2016_05_18, cve CVE_2016_1287, confidence High, signature_severity Major, updated_at 2019_07_26;)
Suricata
ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound
suricata·2016-02-12·CVSS 9.8
CVE-2016-1287 [CRITICAL] ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound
ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound
Rule: alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound"; flow:to_server; content:"|84 00 00|"; byte_test:1,<,9,0,relative; byte_jump:1,0,relative,post_offset -4; content:"|00 00 00|"; within:3; byte_test:1,<,8,0,relative; reference:url,blog.exodusintel.com/2016/02/10/firewall-hacking; classtype:trojan-activity; sid:2022506; rev:3; metadata:created_at 2016_02_12, cve CVE_2016_1287, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)
Suricata
ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound 3
suricata·2016-02-12·CVSS 9.8
CVE-2016-1287 [CRITICAL] ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound 3
ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound 3
Rule: alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound 3"; flow:to_server; content:"|84 10|"; depth:2; offset:16; byte_test:2,<,9,12,relative; reference:url,blog.exodusintel.com/2016/02/10/firewall-hacking; classtype:trojan-activity; sid:2022516; rev:2; metadata:created_at 2016_02_12, cve CVE_2016_1287, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
Suricata
ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound 2
suricata·2016-02-12·CVSS 9.8
CVE-2016-1287 [CRITICAL] ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound 2
ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound 2
Rule: alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound 2"; flow:to_server; content:"|84 20|"; depth:2; offset:16; byte_test:2,<,9,12,relative; reference:url,blog.exodusintel.com/2016/02/10/firewall-hacking; classtype:trojan-activity; sid:2022515; rev:2; metadata:created_at 2016_02_12, cve CVE_2016_1287, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
2019-09-11
Published