PT-2017-14696 · Amazon · Amazon Audible For Windows

Publicado 2017-12-06 · Atualizado 2017-12-20 · CVE-2017-17069

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Amazon Audible for Windows versions prior to November 2017

Description The issue allows attackers to execute arbitrary DLL code. This can happen when ActiveSetupN.exe is launched from a directory where an attacker has already created a Trojan horse dwmapi.dll file.

Recommendations For Amazon Audible for Windows versions prior to November 2017, update to a version released after November 2017 to resolve the issue.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2017-17069

Produtos afetados

Amazon Audible For Windows

Referências · 5

• http://securityfocus.com/bid/102044 · Nota
• https://twitter.com/LionHeartRoxx/status/936338288314540032 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-17069 · Nota de Segurança
• https://packetstormsecurity.com/files/145202/Amazon-Audible-DLL-Hijacking.html · Nota
• https://osv.dev/vulnerability/CVE-2017-17069 · Aviso do Fabricante