PT-2019-9849 · Unknown · Driveragent

Publicado 2019-01-03 · Atualizado 2019-02-08 · CVE-2018-19523

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions DriverAgent version 2.2015.7.14

Description The issue allows a user to send an IOCTL (0x80002068) with a user-defined buffer size. If the size of the buffer is less than 512 bytes, the driver will overwrite the next pool header if there is one next to the user buffer's pool.

Recommendations For DriverAgent version 2.2015.7.14, as a temporary workaround, consider restricting the use of the IOCTL (0x80002068) until a patch is available. Avoid using buffer sizes less than 512 bytes in the affected IOCTL to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2018-19523

Produtos afetados

Driveragent

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-19523 · Nota de Segurança
• https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86ahttps://downwithup.github.io/CVEPosts.html · Nota
• https://osv.dev/vulnerability/CVE-2018-19523 · Aviso do Fabricante
• https://downwithup.github.io/CVEPosts.html · Nota