CVE-2019-0703
Microsoft Windows SMB Information Disclosure Vulnerability
Description
CVE-2019-0703 is an information disclosure vulnerability in the Windows SMB Server caused by improper handling of certain requests. This flaw allows an authenticated attacker to send specially crafted requests to the SMB Server and obtain sensitive information that could be used to further compromise the system. CISA has included CVE-2019-0703 in the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS percentile of 95.4%, this vulnerability is highly likely to be exploited and poses a significant risk to organizations running affected Windows systems with SMB services exposed.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 1709 | - |
| microsoft | windows server 1803 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0703(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0703(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200 describes a weakness where a product exposes sensitive information to actors not authorized to access it. In CVE-2019-0703, the Windows SMB Server fails to properly handle certain requests, causing it to leak information from server memory that can reveal sensitive data about the system's internal state, memory layout, or configuration.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2019-0703 is an information disclosure vulnerability in the Windows SMB Server that allows an attacker to extract sensitive information from server memory. The vulnerability is network-exploitable, meaning an attacker with network access to the SMB service can trigger the information leak remotely. The disclosed information may include memory layout details, kernel addresses, or other internal system data that is invaluable for constructing reliable exploits for additional vulnerabilities. In particular, information disclosure from SMB servers is frequently used to bypass Address Space Layout Randomization (ASLR) and other memory protection mechanisms, effectively lowering the barrier for subsequent code execution attacks. The EPSS percentile of 95.4% indicates a very high probability of active exploitation. SMB vulnerabilities are historically among the most targeted network service flaws, as SMB is ubiquitous in Windows enterprise environments and frequently exposed on internal networks.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-0703 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2022. The EPSS percentile of 95.4% places this vulnerability among the most likely-to-be-exploited information disclosure flaws, reflecting significant real-world exploitation activity. SMB Server vulnerabilities have historically been among the most targeted network service flaws — the SMB protocol's central role in Windows enterprise environments and its frequent exposure on internal networks make any SMB vulnerability a high-priority target. CVE-2019-0703 is particularly valuable to attackers as a reconnaissance and ASLR bypass tool that increases the reliability of subsequent exploitation attempts against the same target.
Remediation
- Apply the security updates provided by Microsoft for the Windows SMB Server as directed in the associated security advisory. CISA mandates remediation by June 13, 2022.
- Restrict SMB access to only authorized systems using firewall rules and network segmentation. Block SMB ports (TCP 445, TCP 139) at the network perimeter to prevent external access to SMB services.
- Disable SMBv1 if it is still enabled, as legacy SMB protocol versions have a significantly larger attack surface and are no longer needed in modern Windows environments.
- Implement network monitoring to detect anomalous SMB traffic patterns, including unusual request sequences or high-volume SMB queries from single sources that may indicate exploitation attempts.
- Review and restrict SMB share permissions to enforce the principle of least privilege, ensuring only necessary users and services have access to SMB resources.
Technical Details
CVE-2019-0703 is an information disclosure vulnerability in the Windows SMB Server service that arises from improper handling of certain SMB requests. When the SMB Server processes a malformed or specially crafted request, it fails to properly initialize or clear memory buffers before including them in the response, resulting in the leakage of uninitialized kernel memory contents to the requesting client. This type of information disclosure is particularly valuable to attackers because it can reveal kernel memory addresses and layout information that is otherwise protected by ASLR. With this information, an attacker can calculate the exact memory addresses needed to reliably exploit separate memory corruption vulnerabilities in the Windows kernel or SMB stack. The attack requires the ability to send authenticated SMB requests to the server, but in many enterprise environments, any domain-authenticated user has this capability, making the attack surface substantial in corporate networks.
Frequently Asked Questions
Is CVE-2019-0703 being actively exploited?
Yes, CVE-2019-0703 is being actively exploited. CISA has included it in the Known Exploited Vulnerabilities catalog with a June 2022 remediation deadline. The EPSS percentile of 95.4% confirms very high exploitation activity targeting Windows SMB Servers.
What products are affected by CVE-2019-0703?
CVE-2019-0703 affects the Windows SMB Server component in Microsoft Windows. Multiple Windows versions are impacted. Administrators should consult Microsoft's security advisory for the specific list of affected operating system versions.
How do I fix CVE-2019-0703?
Apply Microsoft's security updates for the affected Windows versions. Additionally, restrict SMB access using firewall rules, disable SMBv1, and block SMB ports at the network perimeter. Implement network monitoring for anomalous SMB traffic.
How severe is CVE-2019-0703?
CVE-2019-0703 is a significant information disclosure vulnerability with an EPSS percentile of 95.4%. While it does not directly enable code execution, the information it leaks from server memory can be used to bypass security protections like ASLR, making subsequent exploitation of other vulnerabilities more reliable.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.