7.2
CVSSv2

CVE-2019-1162

Published: 14/08/2019 Updated: 22/08/2019
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system, aka 'Windows ALPC Elevation of Privilege Vulnerability'.

Vulnerability Trend

Recent Articles

Microsoft Patch Tuesday – August 2019
Symantec Threat Intelligence Blog • Ratheesh PM • 14 Aug 2019

This month the vendor has patched 93 vulnerabilities, 27 of which are rated Critical.

Posted: 14 Aug, 201926 Min ReadThreat Intelligence SubscribeFollowtwitterfacebooklinkedinMicrosoft Patch Tuesday – August 2019This month the vendor has patched 93 vulnerabilities, 27 of which are rated Critical.This month Microsoft has patched 93 vulnerabilities, 27 of which are rated Critical.

As always, customers are advised to follow these security best practices:


Install vendor patches as soon ...

20-Year-Old Bug in Legacy Microsoft Code Plagues All Windows Users
Threatpost • Tara Seals • 14 Aug 2019

A 20-year-old vulnerability present in all versions of Microsoft Windows could allow a non-privileged user to run code that will give him or her full SYSTEM privileges on a target machine. The bug is notable because of where it resides: In a legacy, omnipresent protocol named Microsoft CTF.
First reported by Tavis Ormandy at Google Project Zero, the bug (CVE-2019-1162) is tracked by Microsoft as an APLC flaw with a severity level of “important.” Ormandy responsibly reported his finding...

Windows CTF Flaws Enable Attackers to Fully Compromise Systems
BleepingComputer • Sergiu Gatlan • 14 Aug 2019

Several critical design flaws were found by Google Project Zero security researcher Tavis Ormandy in the CTF subsystem (MSCTF) of the Windows Text Services Framework (MSCTF), present in all versions going back as far as Windows XP.
The issues might go even further for Microsoft Offices users since, even though not present in the Windows XP base system, MSCTF would be installed on the system with the productivity suite.
Ormandy says that attackers who are already logged into a Win...

We checked and yup, it's no longer 2001. And yet you can pwn a Windows box via Notepad.exe
The Register • Shaun Nichols in San Francisco • 13 Aug 2019

Google guru shows how WinXP-era text code grants total control

Patch Tuesday Software buried in Windows since the days of WinXP can be abused to take complete control of a PC with the help of good ol' Notepad and some crafty code.
On Tuesday, ace bug-hunter Tavis Ormandy, of Google Project Zero, detailed how a component of the operating system's Text Services Framework, which manages keyboard layouts and text input, could be exploited by malware or rogue logged-in users to gain System-level privileges. Such level of access would grant software nasties...