PT-2018-14754 · Vt · Vt-Designer

Ariele Caltabiano + 1 · Published 2018-11-26 · Updated 2018-12-27 · CVE-2018-18987

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VT-Designer version 2.1.7.31

Description The issue arises from the program populating objects with user-supplied input via a file without first checking for validity, allowing attacker-supplied input to be written to known memory locations. This may cause the program to crash or allow remote code execution.

Recommendations For VT-Designer version 2.1.7.31, as a temporary workaround, consider restricting the ability of the program to populate objects with user-supplied input via files until a patch is available. Avoid using files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-18987

ZDI-18-1361

Affected Products

Vt-Designer

References · 5

• https://osv.dev/vulnerability/CVE-2018-18987 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18987 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1361 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-333-01 · Note
• http://securityfocus.com/bid/106071 · Note