PT-2019-13386 · Alpha5 · Alpha5 Smart Loader

Natnael Samson + 1 · Published 2019-08-19 · Updated 2020-10-16 · CVE-2019-13520

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alpha5 Smart Loader versions prior to 4.2

Description The issue is related to multiple buffer overflow problems. An attacker could use specially crafted project files to overflow the buffer and execute code under the privileges of the application. The vulnerability affects the parsing of different file types, including PLD, SDP, and WPA files, allowing for remote code execution.

Recommendations For Alpha5 Smart Loader versions prior to 4.2, update to version 4.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of file parsing functions for PLD, SDP, and WPA files until a patch is available. Avoid using the vulnerable file parsing functionality for these file types until the issue is resolved.

Fix

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

CVE-2019-13520

ZDI-19-761

ZDI-19-762

ZDI-19-763

ZDI-19-798

ZDI-19-820

Affected Products

Alpha5 Smart Loader

References · 8

• https://zerodayinitiative.com/advisories/ZDI-19-820 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-761 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-762 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-798 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-13520 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-763 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13520 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-19-227-02 · Note