PT-2019-2135 · Cisco · Cisco Directory Connector

Published 2019-04-17 · Updated 2023-03-24 · CVE-2019-1794

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Directory Connector (affected versions not specified)

Description The issue is related to uncontrolled search path elements in the search path processing of Cisco Directory Connector. This could allow an authenticated, local attacker to load a binary of their choosing by placing it earlier in the search path utilized by the connector to locate and load required resources. The vulnerability is also associated with errors in the mechanism for checking the search path of dynamically loaded libraries (DLL), which could enable an attacker to gain unauthorized access to protected information by loading an arbitrary binary file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2019-01897

CVE-2019-1794

Affected Products

Cisco Directory Connector

References · 5

• https://osv.dev/vulnerability/CVE-2019-1794 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-cdc-hijack · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1794 · Security Note
• https://bdu.fstec.ru/vul/2019-01897 · Security Note
• http://securityfocus.com/bid/108032 · Note