CVE-2019-1040: Windows NTLM Tampering Vulnerability

DescriptionCVE.org

A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. To exploit this vulnerability, the attacker would need to tamper with the NTLM exchange. The attacker could then modify flags of the NTLM packet without invalidating the signature. The update addresses the vulnerability by hardening NTLM MIC protection on the server-side.

• Microsoft · Windows 10 Version 1703from 10.0.0 before publication
• Microsoft · Windows 10 Version 1803from 10.0.0 before publication
• Microsoft · Windows Server, version 1803 (Server Core Installation)from 10.0.0 before publication
• Microsoft · Windows 10 Version 1809from 10.0.17763.0 before publication
• Microsoft · Windows 10 Version 1809from 10.0.0 before publication
• Microsoft · Windows Server 2019from 10.0.17763.0 before publication
• Microsoft · Windows Server 2019 (Server Core installation)from 10.0.17763.0 before publication
• Microsoft · Windows 10 Version 1709 for 32-bit Systemsfrom 10.0.0 before publication
• Microsoft · Windows 10 Version 1709from 10.0.0 before publication
• Microsoft · Windows 10 Version 1903 for 32-bit Systemsfrom 10.0.0 before publication
• Microsoft · Windows 10 Version 1903 for x64-based Systemsfrom 10.0.0 before publication
• Microsoft · Windows 10 Version 1903 for ARM64-based Systemsfrom 10.0.0 before publication
• Microsoft · Windows Server, version 1903 (Server Core installation)from 10.0.0 before publication
• Microsoft · Windows 10 Version 1507from 10.0.10240.0 before publication
• Microsoft · Windows 10 Version 1607from 10.0.14393.0 before publication
• Microsoft · Windows Server 2016from 10.0.14393.0 before publication
• Microsoft · Windows Server 2016 (Server Core installation)from 10.0.14393.0 before publication
• Microsoft · Windows 7from 6.1.0 before publication
• Microsoft · Windows 7 Service Pack 1from 6.1.0 before publication
• Microsoft · Windows 8.1from 6.3.0 before publication

Exploitation

Likely to be exploited (10% or more). EPSS gives it a 10% or higher chance of exploitation in the next 30 days.

CISA KEV

Not listed

Public check

No public nuclei template

Vendor

Microsoft

Published

June 2019

Band

Likely to be exploited (10% or more), June 2019

• NVD entrynvd.nist.gov
• CVE recordcve.org
• Vendor advisorymsrc.microsoft.com
• portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2portal.msrc.microsoft.com