PT-2019-15851 · .Net · Tinywall

Pylorak · Publicado 2019-12-30 · Atualizado 2022-01-01 · CVE-2019-19470

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TinyWall versions prior to 2.1.13

Description The issue arises from the unsafe usage of .NET deserialization in Named Pipe message processing, allowing a local attacker to escalate privileges to NT AUTHORITYSYSTEM.

Recommendations For versions prior to 2.1.13, update to version 2.1.13 to resolve the issue.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2019-19470

Produtos afetados

Tinywall

Referências · 4

• https://wilderssecurity.com/threads/beta-testing-tinywall.309739/page-62#post-2882843 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-19470 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-19470 · Aviso do Fabricante
• https://gist.github.com/pylorak/7df52c9325614676e07782dbe4e81582 · Nota