CVE Vulnerabilities

CVE-2019-1188

Improper Link Resolution Before File Access ('Link Following')

Published: Aug 14, 2019 | Modified: Aug 24, 2020
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
9.3 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu

A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka LNK Remote Code Execution Vulnerability.

Weakness

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Software

Name Vendor Start Version End Version
Windows_10 Microsoft 1709 1709
Windows_10 Microsoft 1803 1803
Windows_server_2016 Microsoft 1803 1803
Windows_server_2019 Microsoft - -
Windows_10 Microsoft 1809 1809
Windows_server_2016 Microsoft 1903 1903
Windows_10 Microsoft 1903 1903

Potential Mitigations

  • Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References