PT-2023-26783 · Nomachine · Nomachine Free Edition+1

Nsecho · Published 2023-08-04 · Updated 2023-08-10 · CVE-2023-39107

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions NoMachine Free Edition and Enterprise Client for macOS versions prior to 8.8.1

Description An arbitrary file overwrite issue allows attackers to overwrite root-owned files by using hardlinks. This can be exploited in NoMachine Free Edition and Enterprise Client for macOS.

Recommendations For versions prior to 8.8.1, update to version 8.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive root-owned files until the update is applied.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2023-39107

Affected Products

Nomachine Enterprise Client

Nomachine Free Edition

References · 7

• 🔥 https://ns-echo.com/posts/nomachine_afo.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-39107 · Security Note
• https://kb.nomachine.com/TR07U10948 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39107 · Vendor Advisory
• https://kb.nomachine.com/SU07U00247 · Note
• https://t.me/cvenotify/56198 · Telegram Post
• https://t.me/cibsecurity/67784 · Telegram Post