CVE-2019-1084: Infoleak

Published Jul 15, 2019

Updated

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.

Affected Software

22 affected components

Microsoft Exchange Server=2010-sp2

Microsoft Exchange Server=2013-cumulative_update_23

Microsoft Exchange Server=2016-cumulative_update_1

Microsoft Exchange Server=2016-cumulative_update_12

Microsoft Exchange Server=2016-cumulative_update_13

Microsoft Exchange Server=2016-cumulative_update_2

Microsoft Lync=2013-sp1

Microsoft Lync Basic=2013-sp1

Microsoft Mail And Calendar

Microsoft Office=2010-sp2

Microsoft Office=2013-sp1

Microsoft Office=2016

Microsoft Office Mac Os=2016

Microsoft Office=2019

Microsoft Office Macos=2019

Microsoft Office 365 ProPlus

Microsoft Outlook Iphone Os

Microsoft Outlook=2013-sp1

Microsoft Outlook=2016

Microsoft Outlook Android=2016

Microsoft Skype for Business=2016

Microsoft Skype For Business Basic=2016

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1084

Event History

Jul 15, 2019

CVE Published

via MITRE·06:56 PM

Data Sourced

via MITRE·06:56 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2019-1084?

CVE-2019-1084 is an information disclosure vulnerability that exists when Exchange allows creation of entities with Display Names having non-printable characters.

How can an attacker exploit CVE-2019-1084?

An authenticated attacker could exploit CVE-2019-1084 by creating entities with invalid display names, which, when added to conversations, remain invisible.

Which software versions are affected by CVE-2019-1084?

CVE-2019-1084 affects Microsoft Exchange Server 2010 SP2, Microsoft Exchange Server 2013 Cumulative Update 23, and Microsoft Exchange Server 2016 Cumulative Update 1, 12, 13, and 2.

What is the severity of CVE-2019-1084?

The severity of CVE-2019-1084 is medium, with a severity value of 6.5.

How can I fix CVE-2019-1084?

To fix CVE-2019-1084, apply the security updates provided by Microsoft. Refer to the Microsoft Security Advisory for more information.