PT-2019-13386 · Alpha5 · Alpha5 Smart Loader

Natnael Samson + 1 · Publicado 2019-08-19 · Atualizado 2020-10-16 · CVE-2019-13520

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alpha5 Smart Loader versions prior to 4.2

Description The issue is related to multiple buffer overflow problems. An attacker could use specially crafted project files to overflow the buffer and execute code under the privileges of the application. The vulnerability affects the parsing of different file types, including PLD, SDP, and WPA files, allowing for remote code execution.

Recommendations For Alpha5 Smart Loader versions prior to 4.2, update to version 4.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of file parsing functions for PLD, SDP, and WPA files until a patch is available. Avoid using the vulnerable file parsing functionality for these file types until the issue is resolved.

Correção

Stack Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-121

CWE-787

Identificadores relacionados

CVE-2019-13520

ZDI-19-761

ZDI-19-762

ZDI-19-763

ZDI-19-798

ZDI-19-820

Produtos afetados

Alpha5 Smart Loader

Referências · 8

• https://zerodayinitiative.com/advisories/ZDI-19-820 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-19-761 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-19-762 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-19-798 · Nota de Segurança
• https://us-cert.gov/ics/advisories/icsa-19-227-02 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-13520 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-19-763 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-13520 · Aviso do Fabricante