PT-2015-5690 · Telerik · Telerik Analytics Monitor Library

Published 2015-03-13 · Updated 2015-03-13 · CVE-2015-2264

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Telerik Analytics Monitor Library versions prior to 3.2.125

Description The issue concerns untrusted search path vulnerabilities in certain DLL files within the Telerik Analytics Monitor Library. This could allow local users to gain privileges by utilizing a Trojan horse file, such as csunsapi.dll, swift.dll, nfhwcrhk.dll, or surewarehook.dll, placed in an unspecified directory.

Recommendations For versions prior to 3.2.125, update to version 3.2.125 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected DLL files EQATEC.Analytics.Monitor.Win32 vc100.dll and EQATEC.Analytics.Monitor.Win32 vc100-x64.dll to minimize the risk of exploitation. Avoid placing untrusted files in directories that could be used by the Telerik Analytics Monitor Library to load DLLs.

Fix

Related Identifiers

CVE-2015-2264

Affected Products

Telerik Analytics Monitor Library

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-2264 · Security Note
• http://kb.cert.org/vuls/id/794095 · Note