Microsoft Windows RRAS Service CVE-2020-1383 Information Disclosure Vulnerability

Description

An information disclosure vulnerability exists in RPC if the server has Routing and Remote Access enabled. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system To exploit this vulnerability, an attacker would need to run a specially crafted application against an RPC server which has Routing and Remote Access enabled. Routing and Remote Access is a non-default configuration; systems without it enabled are not vulnerable. The security update addresses the vulnerability by correcting how the Routing and Remote Access service handles requests.

Affected Applications

Windows RT 8.1
Windows Server version 2004 (Server Core installation)
Windows Server version 1903 (Server Core installation)
Windows Server 2016
Windows Server 2012
Windows 8
Windows 7
Windows 10
Windows Server 2008
Windows Server version 1909 (Server Core installation)
Windows Server 2019

CVE References

Other References