PT-2018-13224 · Ubisoft · Uplay Desktop Client

Publicado 2018-09-20 · Atualizado 2018-12-13 · CVE-2018-15832

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ubisoft Uplay Desktop Client version 63.0.5699.0

Description The issue is related to the processing of URI handlers in the upc.exe component. It results from the lack of proper validation of a user-supplied string before using it to execute a system call. This allows remote attackers to execute arbitrary code, but user interaction is required, such as visiting a malicious page or opening a malicious file.

Recommendations For Ubisoft Uplay Desktop Client version 63.0.5699.0, consider restricting the use of URI handlers in the upc.exe component until a patch is available. As a temporary workaround, avoid opening suspicious files or links to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-15832

Produtos afetados

Uplay Desktop Client

Referências · 3

• 🔥 https://exploit-db.com/exploits/45429 · Exploit
• https://osv.dev/vulnerability/CVE-2018-15832 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15832 · Nota de Segurança