PT-2019-15267 · Teamviewer · Teamviewer

Peleg Hadar · Publicado 2019-10-24 · Atualizado 2019-11-18 · CVE-2019-18196

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TeamViewer versions prior to 11.0.214397 TeamViewer versions prior to 12.0.214399 TeamViewer versions prior to 13.2.36216 TeamViewer versions prior to 14.7.1965

Description A DLL side loading issue in the Windows Service of TeamViewer could allow an attacker to execute code on a target system via a service restart, provided the DLL was previously installed with administrative privileges. The attacker must be able to create a new file in the TeamViewer application directory, which is restricted by default due to directory permissions.

Recommendations For versions up to 11.0.133222, update to version 11.0.214397 or later. For version 12.0.181268, update to version 12.0.214399 or later. For version 13.2.36215, update to version 13.2.36216 or later. For version 14.6.4835, update to version 14.7.1965 or later.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2019-18196

Produtos afetados

Teamviewer

Referências · 4

• https://safebreach.com/Post/TeamViewer-Windows-Client-v11-to-v14-DLL-Preloading-and-Potential-Abuses-CVE-2019-18196 · Nota
• https://community.teamviewer.com/t5/Announcements/Security-bulletin-CVE-2019-18196/td-p/74564 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-18196 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18196 · Nota de Segurança