PT-2019-18628 · Microsoft+1 · Windows+1

Publicado 2019-12-19 · Atualizado 2020-01-08 · CVE-2019-7487

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SonicOS SSLVPN NACagent version 3.5

Description The issue arises during the installation of the SonicOS SSLVPN NACagent on the Windows operating system. An autorun value is created without quotes around the path, which could allow a malicious binary placed by an attacker within the parent path to execute code.

Recommendations For SonicOS SSLVPN NACagent version 3.5, consider manually adding quotes around the path in the autorun value to prevent potential code execution by malicious binaries. As a temporary workaround, restrict access to the parent path to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-428

Identificadores relacionados

CVE-2019-7487

Produtos afetados

Sonicos Sslvpn Nacagent

Windows

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-7487 · Aviso do Fabricante
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0022 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7487 · Nota de Segurança