PT-2019-12074 · Netskope · Netskope Client Service

Published 2019-09-26 · Updated 2021-09-14 · CVE-2019-10882

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netskope client service versions prior to 57.2.0.219 Netskope client service versions prior to 60.2.0.214

Description The issue is related to a stack-based buffer overflow in the doHandshakefromServer function. This function is part of the connection handling mechanism in the Netskope client service, which runs with NTSYSTEM privilege and accepts network connections from localhost. Local users can exploit this to cause a crash of the service, potentially leading to additional system impact.

Recommendations For versions prior to 57.2.0.219, update to version 57.2.0.219 or later. For versions prior to 60.2.0.214, update to version 60.2.0.214 or later. As a temporary workaround, consider disabling the doHandshakefromServer function until a patch is available.

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-120

Related Identifiers

CVE-2019-10882

Affected Products

Netskope Client Service

References · 5

• https://osv.dev/vulnerability/CVE-2019-10882 · Vendor Advisory
• https://support.netskope.com/hc/article_attachments/360033003553/Sprint_62_Release_Notes.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10882 · Security Note
• https://support.netskope.com/hc/en-us/articles/360014589894-Netskope-Client · Vendor Advisory
• https://airbus-seclab.github.io/advisories/netskope.html · Note