PT-2017-2228 · Infotecs · Vipnet Coordinator+1
Houl777
·
Publicado
2017-06-14
·
Atualizado
2019-10-03
·
CVE-2017-9606
CVSS v3.1
7.3
Alta
| Vetor | AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ViPNet Client versions prior to 4.3.2-42442
ViPNet Coordinator versions prior to 4.3.2-42442
Description
The issue is related to insufficient access control to the update folder and a lack of integrity and authenticity checks for update files. This can allow a local attacker to create a malicious update file containing arbitrary code, place it in the update folder, and then execute it with system or administrator privileges.
Recommendations
For ViPNet Client versions prior to 4.3.2-42442, update to version 4.3.2-42442 or later.
For ViPNet Coordinator versions prior to 4.3.2-42442, update to version 4.3.2-42442 or later.
As a temporary workaround, consider restricting access to the update folder to minimize the risk of exploitation.
Exploit
Correção
Incorrect Permission
Insufficient Verification of Data Authenticity
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Vipnet Client
Vipnet Coordinator