PT-2018-11538 · Softcontrol/Safensoft · Enterprise Suite+2

Artem Ivachev · Published 2018-06-29 · Updated 2019-10-03 · CVE-2018-13012

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SoftControl/SafenSoft SysWatch versions prior to 4.4.12 SoftControl/SafenSoft TPSecure versions prior to 4.4.12 SoftControl/SafenSoft Enterprise Suite versions prior to 4.4.12

Description The issue allows a remote attacker to execute unauthorized code by substituting a forged update server, due to the download of code with improper integrity check in snsupd.exe and upd.exe.

Recommendations For versions prior to 4.4.12, update to version 4.4.12 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2018-13012

Affected Products

Enterprise Suite

Syswatch

Tpsecure

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-13012 · Security Note
• http://safensoft.com/security.phtml?c=865#SNSVE-2018-5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-13012 · Vendor Advisory