PT-2019-9228 · Fujitsu · Paperstream Ip

Published 2019-05-17 · Updated 2021-03-04 · CVE-2018-16156

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PaperStream IP (TWAIN) version 1.42.0.5685 (Service Update 7)

Description The issue concerns the FJTWSVIC service, which runs with SYSTEM privilege and processes unauthenticated messages over a named pipe called FjtwMkic Fjicube 32. A function in this service attempts to load the UninOldIS.dll library dynamically and execute the ChangeUninstallString function. Since the default installation does not include this library, any DLL with the same name found in the directories listed in the PATH variable can be used to escalate privileges to the SYSTEM level.

Recommendations For PaperStream IP (TWAIN) version 1.42.0.5685 (Service Update 7), as a temporary workaround, consider restricting access to the FjtwMkic Fjicube 32 named pipe to minimize the risk of exploitation. Additionally, ensure that no malicious DLLs are present in the directories listed in the PATH variable by regularly monitoring and cleaning up these directories. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2018-16156

Affected Products

Paperstream Ip

References · 5

• 🔥 http://packetstormsecurity.com/files/160832/PaperStream-IP-TWAIN-1.42.0.5685-Local-Privilege-Escalation.html · Exploit
• 🔥 https://exploit-db.com/exploits/49382 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16156 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16156 · Vendor Advisory
• https://securifera.com/advisories/cve-2018-16156 · Note