PT-2019-19431 · Unity · Unity Editor

Rgod · Publicado 2019-03-05 · Atualizado 2020-01-17 · CVE-2019-9197

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unity Editor version 2018.3

Description The issue allows remote attackers to execute arbitrary code through the com.unity3d.kharma protocol handler in the Unity Editor. This is a result of a protocol command injection, enabling remote code execution.

Recommendations For Unity Editor version 2018.3, update to a version that contains a fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting access to the com.unity3d.kharma protocol handler until a patch is available.

Correção

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-9197

ZDI-19-252

Produtos afetados

Unity Editor

Referências · 4

• https://unity3d.com/security#CVE-2019-9197 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-19-252 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-9197 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-9197 · Aviso do Fabricante