PT-2018-14760 · Cscape · Cscape

Mdm + 1 · Published 2018-12-20 · Updated 2019-10-09 · CVE-2018-19005

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cscape versions 9.80.75.3 SP3 and prior

Description An improper input validation issue has been identified, which can be exploited by processing specially crafted files lacking user input validation. This may allow an attacker to read confidential information and remotely execute arbitrary code. The issue is related to the parsing of CSP files and can lead to various types of attacks, including remote code execution and information disclosure.

Recommendations For versions 9.80.75.3 SP3 and prior, update to a version that includes the fix for the improper input validation vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-19005

ZDI-18-1434

ZDI-18-1435

ZDI-18-1436

ZDI-18-1437

ZDI-18-1438

ZDI-18-1439

ZDI-18-1440

ZDI-18-1441

ZDI-18-1442

ZDI-18-1443

ZDI-18-1444

Affected Products

Cscape

References · 15

• https://zerodayinitiative.com/advisories/ZDI-18-1437 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1443 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1434 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1444 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1441 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1438 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1442 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1440 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19005 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1439 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1435 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1436 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-354-01 · Note
• http://securityfocus.com/bid/106275 · Note