PT-2024-27975 · Tellus+1 · Tellus+1

Michael Heinzl · Published 2024-11-28 · Updated 2024-12-03 · CVE-2024-38389

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TELLUS versions 4.0.19.0 and earlier TELLUS Lite versions 4.0.19.0 and earlier

Description The issue is an Out-of-bounds read vulnerability. If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.

Recommendations For TELLUS versions 4.0.19.0 and earlier, consider avoiding the use of the software until a patch is available. For TELLUS Lite versions 4.0.19.0 and earlier, consider avoiding the use of the software until a patch is available. As a temporary workaround, consider restricting the opening of files from untrusted sources to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-38389

Affected Products

Tellus

Tellus Lite

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-38389 · Security Note
• https://twitter.com/cracbot/status/1863825561849868536 · Twitter Post
• https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php · Note
• https://twitter.com/VulmonFeeds/status/1862101574048219314 · Twitter Post
• https://twitter.com/CVEnew/status/1861963678909620472 · Twitter Post
• https://jvn.jp/en/vu/JVNVU97531313 · Note
• https://t.me/cvenotify/102740 · Telegram Post