PT-2018-17676 · Hola · Hola

Filipe Xavier Oliveira · Publicado 2018-03-12 · Atualizado 2019-10-03 · CVE-2018-6623

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hola version 1.79.859

Description An issue was discovered that allows an unprivileged user to modify or overwrite the executable with arbitrary code. This could lead to privilege escalation, depending on the user the service runs as. The issue is due to the SERVICE ALL ACCESS access right for the hola svc and hola updater services.

Recommendations For Hola version 1.79.859, consider restricting access to the hola svc and hola updater services to prevent modification or overwriting of the executable until a fix is available. As a temporary workaround, restrict the SERVICE ALL ACCESS access right to minimize the risk of exploitation.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-6623

Produtos afetados

Hola

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-6623 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2018/Mar/23 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-6623 · Nota de Segurança