Microsoft Patch Tuesday – September 2019

This month the vendor has patched 79 vulnerabilities, 18 of which are rated Critical.

As always, customers are advised to follow these security best practices:

• Install vendor patches as soon as they are available.
• Run all software with the least privileges required while still maintaining functionality.
• Avoid handling files from unknown or questionable sources.
• Never visit sites of unknown or questionable integrity.
• Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft's summary of the September 2019 releases can be found here:
https://portal.msrc.microsoft.com/en-us/security-guidance

 

This month's update covers vulnerabilities in:

• Internet Explorer
• Microsoft Edge
• ChakraCore
• Microsoft Office
• Microsoft Windows
• Microsoft Hyper-V
• Graphics Device Interface (GDI)
• Jet Database Engine
• Microsoft Lync Server
• Azure DevOps and Team Foundation Server
• Yammer for Android
• Rome SDK Microsoft
• Microsoft .NET
• Microsoft Exchange Server

The following is a breakdown of the issues being addressed this month:

1. Cumulative Security Update for Microsoft Browsers

   Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1138) MS Rating: Critical

   A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page.

    

   VBScript Remote Code Execution Vulnerability (CVE-2019-1208) MS Rating: Critical

   A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page.

    

   Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1217) MS Rating: Critical

   A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page.

    

   Scripting Engine Memory Corruption Vulnerability (CVE-2019-1221) MS Rating: Critical

   A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page.

    

   VBScript Remote Code Execution Vulnerability (CVE-2019-1236) MS Rating: Critical

   A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page.

    

   Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1237) MS Rating: Critical

   A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page.

    

   Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1298) MS Rating: Critical

   A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page.

    

   Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1300) MS Rating: Critical

   A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page.

    

   Internet Explorer Security Bypass Vulnerability (CVE-2019-1220) MS Rating: Important

   A security-bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs. This could allow an attacker to cause a user to access a URL in a less restricted Internet Security Zone than intended. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page.

    

   Microsoft Edge Information Disclosure Vulnerability (CVE-2019-1299) MS Rating: Important

   An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page.

    

2. Cumulative Security Update for Microsoft Office

   Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2019-1295) MS Rating: Critical

   A remote code execution vulnerability exists in Microsoft SharePoint where unsafe APIs are exposed when importing data. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.

    

   Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2019-1296) MS Rating: Critical

   A remote code execution vulnerability exists in Microsoft SharePoint where unsafe APIs are exposed when importing data. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.

    

   Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2019-1257) MS Rating: Critical

   A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.

    

   Microsoft Office SharePoint XSS Vulnerability (CVE-2019-1262) MS Rating: Important

   A cross-site-scripting vulnerability (XSS) exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.

    

   Microsoft Excel Information Disclosure Vulnerability (CVE-2019-1263) MS Rating: Important

   An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user's computer or data.

    

   Microsoft Office Security Bypass Vulnerability (CVE-2019-1264) MS Rating: Important

   A security-bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.

    

   Microsoft Excel Remote Code Execution Vulnerability (CVE-2019-1297) MS Rating: Important

   A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.

    

   Microsoft SharePoint Privilege Escalation Vulnerability (CVE-2019-1260) MS Rating: Important

   A privilege escalation vulnerability exists in Microsoft SharePoint. An attacker who successfully exploited this vulnerability could attempt to impersonate another user of the SharePoint server.

    

   Microsoft SharePoint Spoofing Vulnerability (CVE-2019-1261) MS Rating: Important

   A spoofing vulnerabilty exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery (CSRF). To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request.

    

   Microsoft SharePoint Spoofing Vulnerability (CVE-2019-1259) MS Rating: Moderate

   A spoofing vulnerabilty exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery (CSRF). To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request.

    

3. Cumulative Security Update for Microsoft Windows Kernel

   Win32k Privilege Escalation Vulnerability (CVE-2019-1256) MS Rating: Important

   A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

    

   Windows Kernel Information Disclosure Vulnerability (CVE-2019-1274) MS Rating: Important

   An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user's system.

    

   Win32k Privilege Escalation Vulnerability (CVE-2019-1285) MS Rating: Important

   A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

    

4. Cumulative Security Update for Microsoft Hyper-V

   Windows Hyper-V Information Disclosure Vulnerability (CVE-2019-1254) MS Rating: Important

   An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk. An attacker could exploit the vulnerability by reading a file to recover kernel memory.

    

   Windows Hyper-V Denial of Service Vulnerability (CVE-2019-0928) MS Rating: Important

   A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash.

    

5. Security Update for Microsoft Graphics

   Windows GDI Information Disclosure Vulnerability (CVE-2019-1252) MS Rating: Important

   An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system.

    

   Windows GDI Information Disclosure Vulnerability (CVE-2019-1286) MS Rating: Important

   An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system.

    

   Microsoft Graphics Components Information Disclosure Vulnerability (CVE-2019-1283) MS Rating: Important

   An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information that could be useful for further exploitation.

    

6. Security Update for Microsoft Windows

   Remote Desktop Services Remote Code Execution Vulnerability (CVE-2019-0787) MS Rating: Critical

   A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client.

    

   Remote Desktop Services Remote Code Execution Vulnerability (CVE-2019-0788) MS Rating: Critical

   A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client.

    

   Remote Desktop Services Remote Code Execution Vulnerability (CVE-2019-1290) MS Rating: Critical

   A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client.

    

   Remote Desktop Services Remote Code Execution Vulnerability (CVE-2019-1291) MS Rating: Critical

   A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client.

    

   LNK Remote Code Execution Vulnerability (CVE-2019-1280) MS Rating: Critical

   A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a . LNK file is processed.

    

   Windows Privilege Escalation Vulnerability (CVE-2019-1215) MS Rating: Important

   A privilege escalation vulnerability exists in the way that the ws2ifsl. sys handles objects in memory.

    

   Windows Privilege Escalation Vulnerability (CVE-2019-1253) MS Rating: Important

   A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions. To exploit this vulnerability, an attacker would first have to gain execution on the victim system.

    

   Windows Denial of Service Vulnerability (CVE-2019-1292) MS Rating: Important

   A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding.

    

   Windows Privilege Escalation Vulnerability (CVE-2019-1303) MS Rating: Important

   A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions. To exploit this vulnerability, an attacker would first have to gain execution on the victim system.

    

   Windows Common Log File System Driver Privilege Escalation Vulnerability (CVE-2019-1214) MS Rating: Important

   A privilege escalation vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

    

   Windows Transaction Manager Information Disclosure Vulnerability (CVE-2019-1219) MS Rating: Important

   An information disclosure vulnerability exists when the Windows Transaction Manager improperly handles objects in memory. An attacker who successfully exploited this vulnerability could potentially read data that was not intended to be disclosed.

    

   Windows ALPC Privilege Escalation Vulnerability (CVE-2019-1269) MS Rating: Important

   A privilege escalation vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system.

    

   Windows ALPC Privilege Escalation Vulnerability (CVE-2019-1272) MS Rating: Important

   A privilege escalation vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system.

    

   Windows Common Log File System Driver Information Disclosure Vulnerability (CVE-2019-1282) MS Rating: Important

   An information disclosure exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle sandbox checks. An attacker who successfully exploited this vulnerability could potentially read data outside their expected limits.

    

   Windows Text Service Framework Privilege Escalation Vulnerability (CVE-2019-1235) MS Rating: Important

   A privilege escalation vulnerability exists in Windows Text Service Framework (TSF) when the TSF server process does not validate the source of input or commands it receives. An attacker who successfully exploited this vulnerability could inject commands or read input sent through a malicious Input Method Editor (IME).

    

   Windows Secure Boot Security Bypass Vulnerability (CVE-2019-1294) MS Rating: Important

   A security-bypass exists when Windows Secure Boot improperly restricts access to debugging functionality. An attacker who successfully exploited this vulnerability could disclose protected kernel memory.

    

   Microsoft Windows Store Installer Privilege Escalation Vulnerability (CVE-2019-1270) MS Rating: Important

   A privilege escalation vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to symbolic link attack. An attacker who successfully exploited this vulnerability could bypass access restrictions to add or remove files.

    

   Windows Media Privilege Escalation Vulnerability (CVE-2019-1271 MS Rating: Important

   An elevation of privilege exists in hdAudio. sys which may lead to an out of band write.

    

   Windows Audio Service Privilege Escalation Vulnerability (CVE-2019-1277) MS Rating: Important

   An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated privileges.

    

   DirectX Information Disclosure Vulnerability (CVE-2019-1216) MS Rating: Important

   An information disclosure vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user's system.

    

   DirectWrite Information Disclosure Vulnerability (CVE-2019-1244) MS Rating: Important

   An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system.

    

   DirectWrite Information Disclosure Vulnerability (CVE-2019-1245) MS Rating: Important

   An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system.

    

   DirectWrite Information Disclosure Vulnerability (CVE-2019-1251) MS Rating: Important

   An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system.

    

   DirectX Privilege Escalation Vulnerability (CVE-2019-1284) MS Rating: Important

   A privilege escalation vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

    

   Windows Network Connectivity Assistant Privilege Escalation Vulnerability (CVE-2019-1287) MS Rating: Important

   A privilege escalation vulnerability exists in the way that the Windows Network Connectivity Assistant handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.

    

   Windows Update Delivery Optimization Privilege Escalation Vulnerability (CVE-2019-1289) MS Rating: Important

   A privilege escalation vulnerability exists when the Windows Update Delivery Optimization does not properly enforce file share permissions. An attacker who successfully exploited the vulnerability could overwrite files that require higher privileges than what the attacker already has.

    

   Active Directory Federation Services XSS Vulnerability (CVE-2019-1273) MS Rating: Important

   A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize certain error messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected ADFS server.

    

   Diagnostics Hub Standard Collector Service Privilege Escalation Vulnerability (CVE-2019-1232) MS Rating: Important

   A privilege escalation vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.

    

   Microsoft Compatibility Appraiser Privilege Escalation Vulnerability (CVE-2019-1267) MS Rating: Important

   A privilege escalation vulnerability exists in Microsoft Compatibility Appraiser where a configuration file, with local privileges, is vulnerable to symbolic hardlink attack. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

    

   Winlogon Privilege Escalation Vulnerability (CVE-2019-1268) MS Rating: Important

   An elevation of privilege exists when Winlogon does not properly handle file path information. An attacker who successfully exploited this vulnerability could run arbitrary code.

    

   Windows Privilege Escalation Vulnerability (CVE-2019-1278) MS Rating: Important

   A privilege escalation vulnerability exists in the way that the unistore.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.

    

   Windows SMB Client Driver Information Disclosure Vulnerability (CVE-2019-1293) MS Rating: Important

   An information disclosure vulnerability exists in Windows when the Windows SMB Client kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could potentially disclose contents of System memory.

    

7. Security Update for Jet Database Engine

   Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1240) MS Rating: Important

   A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.

    

   Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1241) MS Rating: Important

   A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.

    

   Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1242) MS Rating: Important

   A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.

    

   Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1243) MS Rating: Important

   A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.

    

   Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1246) MS Rating: Important

   A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.

    

   Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1247) MS Rating: Important

   A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.

    

   Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1248) MS Rating: Important

   A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.

    

   Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1249) MS Rating: Important

   A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.

    

   Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1250) MS Rating: Important

   A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.

    

8. Security Update for Exchange

   Microsoft Exchange Denial of Service Vulnerability (CVE-2019-1233) MS Rating: Important

   A denial of service vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could cause a remote denial of service against a system.

    

   Microsoft Exchange Spoofing Vulnerability (CVE-2019-1266) MS Rating: Important

   A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks, and attempt to trick the user into disclosing sensitive information.

    

9. Security Update for .NET

   .NET Framework Privilege Escalation Vulnerability (CVE-2019-1142) MS Rating: Important

   A privilege escalation vulnerability exists when the . NET Framework common language runtime (CLR) allows file creation in arbitrary locations.

    

   .NET Core Denial of Service Vulnerability (CVE-2019-1301) MS Rating: Important

   A denial of service vulnerability exists when . NET Core improperly handles web requests.

    

   ASP.NET Core Privilege Escalation Vulnerability (CVE-2019-1302) MS Rating: Important

   A privilege escalation vulnerability exists when a ASP. NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests.

    

10. Security Update for Microsoft Lync Server

    Lync 2013 Information Disclosure Vulnerability (CVE-2019-1209) MS Rating: Important

    An information disclosure vulnerability exists in Lync 2013. An attacker who exploited it could read arbitrary files on the victim's machine.

     

11. Security Update for Team Foundation Server

    Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability (CVE-2019-1306) MS Rating: Critical

    A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly. An attacker who successfully exploited this vulnerability could execute code on the server in the context of the TFS or ADO service account.

     

    Team Foundation Server Cross-site Scripting Vulnerability (CVE-2019-1305) MS Rating: Important

    A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input. An authenticated attacker could exploit the vulnerability by sending a specially crafted payload to the Team Foundation Server, which will get executed in the context of the user every time a user visits the compromised page.

     

12. Security Update for Yammer for Android

    Microsoft Yammer Security Bypass Vulnerability (CVE-2019-1265) MS Rating: Important

    A security-bypass vulnerability exists when Microsoft Yammer App for Android or iOS fails to apply the correct Intune MAM Policy. This could allow an attacker to perform functions that are restricted by Intune Policy.

     

13. Security Update for Rome SDK

    Rome SDK Information Disclosure Vulnerability (CVE-2019-1231) MS Rating: Important

    An Information Disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation. This vulnerability allows an unauthenticated attacker to establish connection with an invalid SSL/TLS server certificate.

     

More information is available on Symantec's free Security Center portal and to our customers through the DeepSight Threat Management System.