PT-2019-10746 · Shimo · Shimo Vpn

Publicado 2019-04-17 · Atualizado 2023-02-02 · CVE-2018-4006

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Crítica

Vetor base

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shimo VPN version 4.1.5.1

Description A privilege escalation issue exists in the Shimo VPN helper service, specifically in the writeConfig functionality. This allows a non-root user to write a file anywhere on the system, potentially enabling a user with local access to elevate their privileges to root. An attacker would need local access to the machine to exploit this issue successfully.

Recommendations For Shimo VPN version 4.1.5.1, consider restricting access to the writeConfig functionality until a patch is available. As a temporary workaround, limit the ability of non-root users to write files to sensitive areas of the system to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-4006

Produtos afetados

Shimo Vpn

Referências · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0675 · Exploit
• https://t.me/cvenotify/43401 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-4006 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-4006 · Nota de Segurança