PT-2012-5721 · Nomachine · No Machine Nx Web Companion

Published 2012-09-19 · Updated 2017-08-29 · CVE-2012-5003

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions No Machine NX Web Companion versions 3.x and earlier

Description The issue arises from the improper verification of update authenticity in nxapplet.jar, allowing user-assisted remote attackers to execute arbitrary code. This can be achieved by crafting specific parameters, such as SiteUrl or RedirectUrl, to point to a malicious client.zip update file.

Recommendations For No Machine NX Web Companion versions 3.x and earlier, consider restricting access to updates until a proper fix is applied, and avoid using the SiteUrl and RedirectUrl parameters with untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-5003

Affected Products

No Machine Nx Web Companion

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-5003 · Security Note
• http://secunia.com/advisories/47685 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72712 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2012-01/0466.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2012-01/0161.html · Note