PT-2019-6166 · Safenet · Safenet Sentinel Ldk License Manager

Publicado 2019-12-05 · Atualizado 2019-12-19 · CVE-2019-18232

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SafeNet Sentinel LDK License Manager versions prior to 7.101

Description The issue is related to incorrect link resolution before file access, allowing an attacker with local access to create, write, and/or delete files in system folders using symbolic links. This can lead to privilege escalation and potentially allow the execution of a malicious DLL, impacting system integrity and availability.

Recommendations For versions prior to 7.101, update to version 7.101 or later to resolve the issue. As a temporary workaround, consider disabling the service configuration of the SafeNet Sentinel LDK License Manager to minimize the risk of exploitation. Restrict access to system folders and monitor for any suspicious activity related to file creation, modification, or deletion.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

BDU:2022-00661

CVE-2019-18232

Produtos afetados

Safenet Sentinel Ldk License Manager

Referências · 7

• https://cisa.gov/uscert/ics/advisories/icsa-19-339-01 · Nota
• https://web-material3.yokogawa.com/1/32133/files/YSAR-22-0002-E.pdf?ga2.190989871.468990549.1642135775-1687224940.1642135766 · Nota
• https://osv.dev/vulnerability/CVE-2019-18232 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2022-00661 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-18232 · Nota de Segurança
• https://us-cert.gov/ics/advisories/icsa-19-339-01 · Nota
• https://cpl.thalesgroup.com/software-monetization/sentinel-drivers · Nota