PT-2019-9256 · Unknown+1 · Lmlzh32.Dll+2

Publicado 2019-02-13 · Atualizado 2019-02-21 · CVE-2018-16190

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UNARJ32.DLL for Win32 version 1.10.1.25 and earlier LHMelting for Win32 version 1.65.3.6 and earlier LMLzh32.DLL version 2.67.1.2 and earlier

Description The issue allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This is due to an untrusted search path vulnerability.

Recommendations For UNARJ32.DLL for Win32 version 1.10.1.25 and earlier, update to a version later than 1.10.1.25 to resolve the issue. For LHMelting for Win32 version 1.65.3.6 and earlier, update to a version later than 1.65.3.6 to resolve the issue. For LMLzh32.DLL version 2.67.1.2 and earlier, update to a version later than 2.67.1.2 to resolve the issue.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2018-16190

Produtos afetados

Lhmelting

Lmlzh32.Dll

Unarj32.Dll

Referências · 7

• http://micco.mars.jp/vul/2017/mhsvi20170515_02.htm · Aviso do Fabricante
• http://micco.mars.jp/vul/2017/mhsvi20170515_04.htm · Aviso do Fabricante
• http://micco.mars.jp/vul/2017/mhsvi20170515_05.htm · Aviso do Fabricante
• https://micco.mars.jp/vul/2017/mhsvi20170515_03.htm · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN52168232/index.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16190 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16190 · Aviso do Fabricante