PT-2019-12150 · Mirasys · Mirasys Vms

Publicado 2019-08-22 · Atualizado 2020-08-24 · CVE-2019-11030

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mirasys VMS versions prior to 7.6.1 Mirasys VMS versions 8.x prior to 8.3.2

Description The issue concerns the mishandling of the Mirasys.Common.Utils.Security.DataCrypt method within the Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector. An attacker can execute a gadget, contained in a serialized object, with SYSTEM privileges if the object is properly encrypted. However, the encryption keys are hardcoded and available.

Recommendations For Mirasys VMS versions prior to 7.6.1, update to version 7.6.1 or later. For Mirasys VMS versions 8.x prior to 8.3.2, update to version 8.3.2 or later.

Correção

Deserialization of Untrusted Data

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-502

CWE-798

Identificadores relacionados

CVE-2019-11030

Produtos afetados

Mirasys Vms

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-11030 · Aviso do Fabricante
• https://kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solution · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11030 · Nota de Segurança