| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sun, 5 Dec 2021 23:34:15 +0100 (CET) From: Gionathan Reale via Fulldisclosure <fulldisclosure@...lists.org> To: Fulldisclosure <fulldisclosure@...lists.org> Subject: [FD] (Reprise License Manager) RLM 14.2 - Authenticated Remote Binary Execution # Product: Reprise License Manager 14.2# Vendor: Reprise Software # CVE ID: CVE-2021-44153 # Vulnerability Title: Authenticated Remote Binary Execution # Severity: High # Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard # Date: 2021-11-25 ############################################################# Introduction: When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables. An attacker can exploit this to run a malicious binary on startup, or when triggering the "Reread/Restart Servers" function on the webserver. (Exploitation does not require CVE-2018-15573, because the license file is meant to be changed in the application.) Vulnerability: A license file containing the following, would execute calc.exe as an example of this vulnerability, it is also possible to provide arguments to the executables: ISV demo "C:\Windows\System32\calc.exe" If CVE-2018-15573 remains unpatched, files could be created on the system and then executed. Recommendation: Don't allow user-specified binaries to be run. Use a allow-list if absolutely required. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists