PT-2017-2228 · Infotecs · Vipnet Coordinator+1
Houl777
·
Published
2017-06-14
·
Updated
2019-10-03
·
CVE-2017-9606
CVSS v3.1
7.3
High
| Vector | AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ViPNet Client versions prior to 4.3.2-42442
ViPNet Coordinator versions prior to 4.3.2-42442
Description
The issue is related to insufficient access control to the update folder and a lack of integrity and authenticity checks for update files. This can allow a local attacker to create a malicious update file containing arbitrary code, place it in the update folder, and then execute it with system or administrator privileges.
Recommendations
For ViPNet Client versions prior to 4.3.2-42442, update to version 4.3.2-42442 or later.
For ViPNet Coordinator versions prior to 4.3.2-42442, update to version 4.3.2-42442 or later.
As a temporary workaround, consider restricting access to the update folder to minimize the risk of exploitation.
Exploit
Fix
Incorrect Permission
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Vipnet Client
Vipnet Coordinator