PT-2017-14696 · Amazon · Amazon Audible For Windows

Published 2017-12-06 · Updated 2017-12-20 · CVE-2017-17069

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Amazon Audible for Windows versions prior to November 2017

Description The issue allows attackers to execute arbitrary DLL code. This can happen when ActiveSetupN.exe is launched from a directory where an attacker has already created a Trojan horse dwmapi.dll file.

Recommendations For Amazon Audible for Windows versions prior to November 2017, update to a version released after November 2017 to resolve the issue.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2017-17069

Affected Products

Amazon Audible For Windows

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-17069 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17069 · Vendor Advisory
• http://securityfocus.com/bid/102044 · Note
• https://twitter.com/LionHeartRoxx/status/936338288314540032 · Note
• https://packetstormsecurity.com/files/145202/Amazon-Audible-DLL-Hijacking.html · Note