PT-2015-5690 · Telerik · Telerik Analytics Monitor Library

Publicado 2015-03-13 · Atualizado 2015-03-13 · CVE-2015-2264

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Telerik Analytics Monitor Library versions prior to 3.2.125

Description The issue concerns untrusted search path vulnerabilities in certain DLL files within the Telerik Analytics Monitor Library. This could allow local users to gain privileges by utilizing a Trojan horse file, such as csunsapi.dll, swift.dll, nfhwcrhk.dll, or surewarehook.dll, placed in an unspecified directory.

Recommendations For versions prior to 3.2.125, update to version 3.2.125 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected DLL files EQATEC.Analytics.Monitor.Win32 vc100.dll and EQATEC.Analytics.Monitor.Win32 vc100-x64.dll to minimize the risk of exploitation. Avoid placing untrusted files in directories that could be used by the Telerik Analytics Monitor Library to load DLLs.

Correção

Identificadores relacionados

CVE-2015-2264

Produtos afetados

Telerik Analytics Monitor Library

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-2264 · Nota de Segurança
• http://kb.cert.org/vuls/id/794095 · Nota