PT-2019-12529 · Softether · See.Sys+1

Downwithup · Published 2019-07-29 · Updated 2021-08-27 · CVE-2019-11868

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SoftEther VPN Server versions up to 4.29 See.sys up to version 4.25

Description The issue allows a user to call an IOCTL, specifying any kernel address to which arbitrary bytes are written. This can potentially lead to unauthorized access and modification of kernel memory.

Recommendations For SoftEther VPN Server versions up to 4.29, update See.sys to a version newer than 4.25 to resolve the issue. For See.sys up to version 4.25, consider restricting access to the IOCTL function until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-11868

Affected Products

See.Sys

Softether Vpn Server

References · 5

• https://softether.org/9-about/News/900-SEVPN201901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11868 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11868 · Vendor Advisory
• https://github.com/SoftEtherVPN/SoftEtherVPN/tree/master/src/See · Note
• https://downwithup.github.io/CVEPosts · Note