PT-2017-7775 · Akamai · Akamai Netsession

Publicado 2017-01-23 · Atualizado 2017-02-07 · CVE-2016-10157

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Akamai NetSession version 1.9.3.1

Description The issue is related to DLL Hijacking, where Akamai NetSession tries to load CSUNSAPI.dll without providing the complete path. This is exacerbated by the absence of the mentioned DLL from the installation, allowing for DLL hijacking and potential code injection within the Akamai NetSession process space.

Recommendations For Akamai NetSession version 1.9.3.1, consider restricting the loading of DLLs to only those with fully specified paths to mitigate the risk of DLL hijacking. As a temporary workaround, ensure that no malicious CSUNSAPI.dll is loaded by the application. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2016-10157

Produtos afetados

Akamai Netsession

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-10157 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-10157 · Aviso do Fabricante
• http://securityfocus.com/bid/95995 · Nota
• https://packetstormsecurity.com/files/140366/Akamai-NetSession-1.9.3.1-DLL-Hijacking.html · Nota