PT-2019-12635 · Netskope · Netskope Client Service

Publicado 2019-09-26 · Atualizado 2019-10-09 · CVE-2019-12091

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netskope client service versions 57 before 57.2.0.219 Netskope client service versions 60 before 60.2.0.214

Description The issue concerns a command injection vulnerability in the connection handling function of the Netskope client service. This vulnerability allows local users to execute code with NTSYSTEM privilege, given that the service runs with this privilege and accepts network connections from localhost.

Recommendations For versions 57 before 57.2.0.219, update to version 57.2.0.219 or later to resolve the issue. For versions 60 before 60.2.0.214, update to version 60.2.0.214 or later to resolve the issue.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-12091

Produtos afetados

Netskope Client Service

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-12091 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12091 · Nota de Segurança
• https://support.netskope.com/hc/article_attachments/360033003553/Sprint_62_Release_Notes.pdf · Aviso do Fabricante
• https://airbus-seclab.github.io/advisories/netskope.html · Nota
• https://support.netskope.com/hc/en-us/articles/360014589894-Netskope-Client · Aviso do Fabricante