PT-2018-9989 · Cncsoft · Cncsoft+1

Mat Powell · Published 2018-08-13 · Updated 2019-10-09 · CVE-2018-10598

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: CNCSoft versions 1.00.83 and prior CNCSoft ScreenEditor versions 1.00.54 and prior

Description: The issue is related to two out-of-bounds read vulnerabilities that could cause the software to crash due to lacking user input validation for processing project files. This may allow an attacker to gain remote code execution with administrator privileges if exploited.

Recommendations: For CNCSoft versions 1.00.83 and prior, update to a version that includes input validation for project files to prevent out-of-bounds read vulnerabilities. For CNCSoft ScreenEditor versions 1.00.54 and prior, restrict access to project files until a patch is available that addresses the out-of-bounds read vulnerabilities.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2018-10598

ZDI-18-987

ZDI-18-988

Affected Products

Cncsoft

Cncsoft Screeneditor

References · 6

• https://zerodayinitiative.com/advisories/ZDI-18-987 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-10598 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10598 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-18-988 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-219-01 · Note
• http://securityfocus.com/bid/105032 · Note