PT-2012-5721 · Nomachine · No Machine Nx Web Companion

Publicado 2012-09-19 · Atualizado 2017-08-29 · CVE-2012-5003

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions No Machine NX Web Companion versions 3.x and earlier

Description The issue arises from the improper verification of update authenticity in nxapplet.jar, allowing user-assisted remote attackers to execute arbitrary code. This can be achieved by crafting specific parameters, such as SiteUrl or RedirectUrl, to point to a malicious client.zip update file.

Recommendations For No Machine NX Web Companion versions 3.x and earlier, consider restricting access to updates until a proper fix is applied, and avoid using the SiteUrl and RedirectUrl parameters with untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2012-5003

Produtos afetados

No Machine Nx Web Companion

Referências · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/72712 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2012-01/0466.html · Nota
• http://archives.neohapsis.com/archives/bugtraq/2012-01/0161.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5003 · Nota de Segurança
• http://secunia.com/advisories/47685 · Aviso do Fabricante