PT-2019-8692 · Inplc · Inplc Sdk Pro++1

Kotatsu Shiraki · Publicado 2019-01-09 · Atualizado 2019-01-22 · CVE-2018-0667

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions INplc SDK Express versions 3.08 and earlier INplc SDK Pro+ versions 3.08 and earlier

Description The issue is related to an untrusted search path vulnerability in the Installer of the affected software. This vulnerability allows an attacker to gain privileges by using a Trojan horse DLL in an unspecified directory.

Recommendations For INplc SDK Express versions 3.08 and earlier, update to a version later than 3.08 to resolve the issue. For INplc SDK Pro+ versions 3.08 and earlier, update to a version later than 3.08 to resolve the issue. As a temporary workaround, consider restricting access to the Installer to minimize the risk of exploitation.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2018-0667

Produtos afetados

Inplc Sdk Express

Inplc Sdk Pro+

Referências · 4

• https://jvn.jp/en/jp/JVN59624986/index.html · Nota
• http://mnc.co.jp/INplc/info_20180907_E.htm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0667 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-0667 · Aviso do Fabricante