PT-2018-17980 · Flight Sim · A320-X

Publicado 2018-02-20 · Atualizado 2019-10-03 · CVE-2018-7259

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flight Sim Labs A320-X installer version 2.0.1.231

Description The installer sends a user's Google account credentials to "http://installLog.flightsimlabs.com/LogHandler3.ashx" if a pirated serial number has been entered, allowing remote attackers to obtain sensitive information by sniffing the network for cleartext HTTP traffic.

Recommendations For version 2.0.1.231, update to version 2.0.1.232 to resolve the issue. As a temporary workaround, consider avoiding the use of the installer with potentially pirated serial numbers and restricting network access to minimize the risk of exploitation.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2018-7259

Produtos afetados

A320-X

Referências · 5

• https://medium.com/%40lukegorman97/flightsimlabs-alleged-malware-analysis-1427c4d23368 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7259 · Nota de Segurança
• https://reddit.com/r/flightsim/comments/7yh4zu/fslabs_a320_installer_seems_to_include_a_chrome · Nota
• https://forums.flightsimlabs.com/index.php?/topic/16210-malware-in-installer · Nota
• https://osv.dev/vulnerability/CVE-2018-7259 · Aviso do Fabricante