PT-2018-1951 · Iobit · Iobit Advanced Systemcare

Published 2018-09-25 · Updated 2018-12-27 · CVE-2018-16712

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions IObit Advanced SystemCare versions 1.2.0.5 and earlier

Description The issue is related to insufficient data protection in the utility. It allows a user to send a specially crafted IOCTL 0x9C406104 to read physical memory, potentially disclosing protected information.

Recommendations For IObit Advanced SystemCare versions 1.2.0.5 and earlier, consider restricting access to the Monitor win10 x64.sys and Monitor win7 x64.sys files to minimize the risk of exploitation. As a temporary workaround, avoid using the IOCTL 0x9C406104 until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2018-01558

CVE-2018-16712

Affected Products

Iobit Advanced Systemcare

References · 7

• 🔥 https://github.com/DownWithUp/CVE-2018-16712 · Exploit
• 🔥 https://downwithup.github.io/CVEPosts.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16712 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16712 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01558 · Security Note
• https://vuldb.com/?id.124490 · Note
• https://cxsecurity.com/cveshow/CVE-2018-16712 · Note