Vulnerability Name: | CVE-2019-0890 (CCN-160368) |
Assigned: | 2018-11-26 |
Published: | 2019-05-14 |
Updated: | 2020-08-24 |
Summary: | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
|
CVSS v3 Severity: | 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) 6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)Exploitability Metrics: | Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required | Scope: | Scope (S): Unchanged
| Impact Metrics: | Confidentiality (C): High Integrity (I): High Availibility (A): High | 7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) 6.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)Exploitability Metrics: | Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required | Scope: | Scope (S): Unchanged
| Impact Metrics: | Confidentiality (C): High Integrity (I): High Availibility (A): High |
|
CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)Exploitability Metrics: | Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None | Impact Metrics: | Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete | 6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)Exploitability Metrics: | Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
| Impact Metrics: | Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete |
|
Vulnerability Type: | CWE-noinfo
|
Vulnerability Consequences: | Gain Access |
References: | Source: MITRE Type: CNA CVE-2019-0890
Source: XF Type: UNKNOWN ms-windows-cve20190890-code-exec(160368)
Source: CCN Type: Microsoft Security TechCenter - May 2019 Jet Database Engine Remote Code Execution Vulnerability
Source: MISC Type: Patch, Vendor Advisory https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0890
Source: CCN Type: ZDI-19-474 Microsoft Windows JET Database Engine Integer Underflow Remote Code Execution Vulnerability
|
Vulnerable Configuration: | Configuration 1: cpe:/o:microsoft:windows_10:-:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1607:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1703:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1709:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1803:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1809:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1903:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_7:-:sp1:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8.1:-:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Configuration CCN 1: cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:itanium:*OR cpe:/o:microsoft:windows_7:-:sp1:-:*:-:-:x32:*OR cpe:/o:microsoft:windows_7:*:sp1:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8.1:-:-:-:*:-:-:x32:*OR cpe:/o:microsoft:windows_8.1:*:*:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:-:*:*:*:*:*:x32:*OR cpe:/o:microsoft:windows_10:*:*:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server:1803:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:-:*:*:*:*:*:arm64:*OR cpe:/o:microsoft:windows_server:1903:*:*:*:*:*:*:* Denotes that component is vulnerable |
BACK |
microsoft windows 10 -
microsoft windows 10 1607
microsoft windows 10 1703
microsoft windows 10 1709
microsoft windows 10 1803
microsoft windows 10 1809
microsoft windows 10 1903
microsoft windows 7 - sp1
microsoft windows 8.1 -
microsoft windows rt 8.1 -
microsoft windows server 2008 - sp2
microsoft windows server 2008 r2 sp1
microsoft windows server 2008 r2 sp1
microsoft windows server 2012 -
microsoft windows server 2012 r2
microsoft windows server 2016 -
microsoft windows server 2016 1803
microsoft windows server 2016 1903
microsoft windows server 2019 -
microsoft windows server 2008 sp2
microsoft windows server 2008 sp2
microsoft windows server 2008
microsoft windows 7 - sp1
microsoft windows 7 * sp1
microsoft windows server 2008 r2
microsoft windows server 2008 r2
microsoft windows server 2012
microsoft windows 8.1 - -
microsoft windows 8.1 *
microsoft windows server 2012 r2
microsoft windows rt 8.1 *
microsoft windows 10 -
microsoft windows 10 *
microsoft windows server 2016
microsoft windows server 1803
microsoft windows server 2019
microsoft windows 10 -
microsoft windows server 1903