PT-2021-23064 · Listary · Listary

Published 2021-12-14 · Updated 2021-12-17 · CVE-2021-41067

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Listary versions prior to 7

Description An issue exists due to the improper implementation of the update process, which uses a /check-update HTTP-based connection to download software updates. This can be exploited using Man-In-The-Middle (MITM) techniques. Additionally, the lack of package validation can lead to the manipulation of update packages, potentially resulting in the installation of malicious content.

Recommendations For versions prior to 7, update to version 7 or later to resolve the issue. As a temporary workaround, consider restricting access to the update process to minimize the risk of exploitation. Avoid using HTTP-based connections for software updates until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2021-41067

Affected Products

Listary

References · 5

• 🔥 https://medium.com/@tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-41067 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41067 · Vendor Advisory
• https://listary.com/download · Vendor Advisory
• https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e · Note