7.5

CVE-2019-1006

EPSS 2.93%
Published 15.07.2019 19:15:16
Last modified 21.11.2024 04:35:49
Source secure@microsoft.com
Teams watchlist Login
Open Login

An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Microsoft ≫ .Net Framework Version2.0 Updatesp2

Microsoft ≫ Windows Server 2008 Version- Updatesp2

Microsoft ≫ .Net Framework Version3.0 Updatesp2

Microsoft ≫ Windows Server 2008 Version- Updatesp2

Microsoft ≫ .Net Framework Version3.5

   Microsoft ≫ Windows 10 Version-
   Microsoft ≫ Windows 10 Version1607
   Microsoft ≫ Windows 10 Version1703
   Microsoft ≫ Windows 10 Version1709
   Microsoft ≫ Windows 10 Version1803
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2
   Microsoft ≫ Windows Server 2016 Version-
   Microsoft ≫ Windows Server 2016 Version1803

Microsoft ≫ .Net Framework Version3.5

Microsoft ≫ Windows 10 Version1809
Microsoft ≫ Windows Server 2019 Version-

Microsoft ≫ .Net Framework Version4.7.2

Microsoft ≫ Windows 10 Version1809
Microsoft ≫ Windows Server 2019 Version-

Microsoft ≫ .Net Framework Version3.5

   Microsoft ≫ Windows 10 Version1809
   Microsoft ≫ Windows 10 Version1903
   Microsoft ≫ Windows Server 2019 Version-

Microsoft ≫ .Net Framework Version4.8

   Microsoft ≫ Windows 10 Version1809
   Microsoft ≫ Windows 10 Version1903
   Microsoft ≫ Windows Server 2019 Version-

Microsoft ≫ .Net Framework Version3.5.1

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformitanium
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64

Microsoft ≫ .Net Framework Version4.5.2

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Version- Updatesp2
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.6

Microsoft ≫ Windows Server 2008 Version- Updatesp2

Microsoft ≫ .Net Framework Version4.6

Microsoft ≫ Windows 10 Version-

Microsoft ≫ .Net Framework Version4.6.1

Microsoft ≫ Windows 10 Version-

Microsoft ≫ .Net Framework Version4.6.2

Microsoft ≫ Windows 10 Version-

Microsoft ≫ .Net Framework Version4.6

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.6.1

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.6.2

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.7

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.7.1

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.7.2

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.8

   Microsoft ≫ Windows 10 Version1607
   Microsoft ≫ Windows 10 Version1703
   Microsoft ≫ Windows 10 Version1709
   Microsoft ≫ Windows 10 Version1803
   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2
   Microsoft ≫ Windows Server 2016 Version-
   Microsoft ≫ Windows Server 2016 Version1803

Microsoft ≫ Identitymodel Version7.0.0

Microsoft ≫ Sharepoint Enterprise Server Version2013 Updatesp1

Microsoft ≫ Sharepoint Enterprise Server Version2016

Microsoft ≫ Sharepoint Foundation Version2010 Updatesp2

Microsoft ≫ Sharepoint Foundation Version2013 Updatesp1

Microsoft ≫ Sharepoint Server Version2019

Microsoft ≫ Windows 10 Version-

Microsoft ≫ Windows 10 Version1607

Microsoft ≫ Windows 10 Version1703

Microsoft ≫ Windows 10 Version1709

Microsoft ≫ Windows 10 Version1803

Microsoft ≫ Windows 10 Version1809

Microsoft ≫ Windows 10 Version1903

Microsoft ≫ Windows 7 Version- Updatesp1

Microsoft ≫ Windows 8.1 Version-

Microsoft ≫ Windows Rt 8.1 Version-

Microsoft ≫ Windows Server 2008 Version- Updatesp2

Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformitanium

Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64

Microsoft ≫ Windows Server 2012 Version-

Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ Windows Server 2016 Version-

Microsoft ≫ Windows Server 2016 Version1803

Microsoft ≫ Windows Server 2016 Version1903

Microsoft ≫ Windows Server 2019 Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	2.93%	0.859

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1006

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-1006

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-1006

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-1006

EUVD