PT-2019-12529 · Softether · See.Sys+1

Downwithup · Publicado 2019-07-29 · Atualizado 2021-08-27 · CVE-2019-11868

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SoftEther VPN Server versions up to 4.29 See.sys up to version 4.25

Description The issue allows a user to call an IOCTL, specifying any kernel address to which arbitrary bytes are written. This can potentially lead to unauthorized access and modification of kernel memory.

Recommendations For SoftEther VPN Server versions up to 4.29, update See.sys to a version newer than 4.25 to resolve the issue. For See.sys up to version 4.25, consider restricting access to the IOCTL function until a patch is available.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2019-11868

Produtos afetados

See.Sys

Softether Vpn Server

Referências · 5

• https://github.com/SoftEtherVPN/SoftEtherVPN/tree/master/src/See · Nota
• https://softether.org/9-about/News/900-SEVPN201901 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11868 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11868 · Aviso do Fabricante
• https://downwithup.github.io/CVEPosts · Nota