PT-2018-13054 · Zemana · Zemana Antilogger

Published 2018-08-18 · Updated 2019-10-03 · CVE-2018-15491

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zemana Anti-Logger versions prior to 1.9.3.602

Description A flaw in the permission and encryption implementation allows an attacker to control the whitelisting feature, enabling the execution of unauthorized applications, such as keystroke recorders, by modifying the MyRules2.ini file under %LOCALAPPDATA%ZemanaZALSDK.

Recommendations For versions prior to 1.9.3.602, update to version 1.9.3.602 or later to resolve the issue. As a temporary workaround, consider restricting access to the MyRules2.ini file to prevent unauthorized modifications until a patch is applied.

Exploit

Fix

Incorrect Permission

Using Hardcoded Credentials

Weakness Enumeration

CWE-732

CWE-798

Related Identifiers

CVE-2018-15491

Affected Products

Zemana Antilogger

References · 4

• 🔥 https://github.com/mspaling/zemana-exclusions-poc/blob/master/zemana-whitelist-poc.txt · Exploit
• https://osv.dev/vulnerability/CVE-2018-15491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15491 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148554 · Note