PT-2018-17559 · March Hare · Wincvs+1

Hyp3Rlinx + 1 · Publicado 2018-02-05 · Atualizado 2018-03-13 · CVE-2018-6461

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions March Hare WINCVS versions prior to 2.8.01 build 6610 March Hare CVS Suite versions prior to 2009R2 build 6610

Description The issue is related to an Insecure Library Loading vulnerability in the wincvs2.exe or wincvs.exe file. This may allow local users to gain privileges via a Trojan horse Python or TCL DLL file in the current working directory.

Recommendations For March Hare WINCVS versions prior to 2.8.01 build 6610, update to version 2.8.01 build 6610 or later. For March Hare CVS Suite versions prior to 2009R2 build 6610, update to version 2009R2 build 6610 or later.

Exploit

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2018-6461

Produtos afetados

Cvs Suite

Wincvs

Referências · 6

• 🔥 http://seclists.org/fulldisclosure/2018/Feb/24 · Exploit
• 🔥 http://packetstormsecurity.com/files/146267/WINCVS-2009R2-DLL-Hijacking.html · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/CVS-SUITE-2009R2-INSECURE-LIBRARY-LOADING-CVE-2018-6461.txt · Exploit
• http://march-hare.com/cvspro/vulnwincvs.htm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-6461 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-6461 · Aviso do Fabricante