PT-2019-1398 · Wibu Systems · Wibukey.Sys

Publicado 2019-01-28 · Atualizado 2022-04-19 · CVE-2018-3990

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Crítica

Vetor base

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WibuKey.sys version 6.40 (Build 2400)

Description The issue is related to a buffer overflow in the 0x8200E804 IOCTL handler functionality of WibuKey.sys. This can be exploited by sending a specially crafted IRP request, leading to kernel memory corruption and potentially allowing privilege escalation.

Recommendations For version 6.40 (Build 2400), consider disabling the 0x8200E804 IOCTL handler functionality until a patch is available to prevent potential exploitation. Restrict access to the WibuKey.sys module to minimize the risk of kernel memory corruption. Avoid using specially crafted IRP requests to the 0x8200E804 IOCTL handler until the issue is resolved.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2019-00770

CVE-2018-3990

Produtos afetados

Wibukey.Sys

Referências · 9

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0658 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3990 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-3989 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-00770 · Nota de Segurança
• http://securityfocus.com/bid/107005 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-760124.pdf · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-844562.pdf · Nota
• https://osv.dev/vulnerability/CVE-2018-3990 · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/pdf/ssa-902727.pdf · Nota