PT-2014-8558 · Estsoft · Alupdate

Published 2014-11-03 · Updated 2017-09-08 · CVE-2014-8494

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ESTsoft ALUpdate version 8.5.1.0.0

Description The issue concerns weak permissions set for the AlUpdate folder and AlUpdate.exe, allowing local users to gain privileges through a Trojan horse file. This could potentially lead to unauthorized access and control.

Recommendations For ESTsoft ALUpdate version 8.5.1.0.0, consider restricting access to the AlUpdate folder and AlUpdate.exe to prevent local users from exploiting the weak permissions and gaining unauthorized privileges.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-8494

Affected Products

Alupdate

References · 4

• 🔥 http://packetstormsecurity.com/files/128868/ESTsoft-ALUpdate-8.5.1.0.0-Privilege-Escalation.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8494 · Security Note
• http://securityfocus.com/bid/70790 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98315 · Note