Stefan Kanthak

O problema está relacionado à validação insuficiente de entradas na Ferramenta de Solução de Problemas de Metadados de Impressoras da Microsoft, o que pode permitir que um invasor execute código arbitrário. Houve relatos de exploração dessa vulnerabilidade, com a descoberta de uma vulnerabilidade de sequestro de DLL na ferramenta. Estima-se que os dispositivos que baixaram a ferramenta antes de 5 de janeiro de 2024 possam ser afetados.

The issue is related to improper access control, which may allow a privileged user to potentially enable escalation of privilege via local access.

Foi identificada uma vulnerabilidade no software, afetando uma funcionalidade desconhecida, que leva a um caminho de pesquisa descontrolado. O ataque pode ser lançado remotamente. A exploração foi divulgada ao público e pode estar em uso.

A vulnerabilidade pode permitir que um invasor coloque arquivos maliciosos no mesmo diretório, o que pode levar à execução remota de código (RCE) arbitrária quando esses arquivos forem executados. Um vetor de ataque semelhante a uma vulnerabilidade identificada anteriormente foi descoberto e resolvido em uma versão posterior da ferramenta.

The issue is related to an Untrusted Search Path vulnerability, which could lead to arbitrary code execution with SYSTEM privileges when a malicious DLL library is loaded by the product.

A race condition existed during the installation of iCloud for Windows, which could result in arbitrary code execution if the iCloud installer is run in an untrusted directory. This issue was addressed with improved state handling.

A race condition existed during the installation of iTunes for Windows, which could result in arbitrary code execution if the iTunes installer is run in an untrusted directory. This issue was addressed with improved state handling.

Name of the Vulnerable Software and Affected Versions: Akeo Consulting Rufus versions 3.0 and earlier Description: The issue concerns insecure permissions, allowing for arbitrary code execution with escalation of privilege. This affects the executable installer and all portable executables. The attack vector involves CWE-29, CWE-377, and CWE-379, which relate to path traversal and permission issues. Recommendations: For versions 3.0 and earlier, update to a version that addresses the insecure permissions issue to prevent arbitrary code execution and privilege escalation. As a temporary workaround, consider restricting access to the executable installer and portable executables to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Akeo Consulting Rufus versions 3.0 and earlier Description: The issue affects executable installers and portable executables, allowing for DLL search order hijacking. This can lead to arbitrary code execution with escalation of privilege. The attack vector involves CAPEC-471, CWE-426, and CWE-427. Recommendations: For Akeo Consulting Rufus versions 3.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insufficient input validation in the installer, which may allow an unprivileged user to potentially elevate privileges or cause an installer denial of service via local access. This could lead to arbitrary code execution with escalation of privilege via the Intel Rapid Storage Technology User Interface and Driver.

A DLL Hijacking issue could allow remote attackers to execute arbitrary code on Windows machines.

The issue allows local users to execute arbitrary code with administrator privileges and conduct DLL hijacking attacks via a Trojan horse DLL in the application directory. This can be demonstrated with the USP10.dll, RichEd20.dll, NTMarta.dll, and SRClient.dll DLLs.

The issue is related to an untrusted search path vulnerability in the installer. This vulnerability can be exploited by a local user to gain privileges via a Trojan horse DLL in the current working directory.

The issue is related to an untrusted search path vulnerability in Adobe Flash Player. This vulnerability allows local users to gain privileges via a Trojan horse resource in an unspecified directory. The exploitation of this vulnerability can enable a local attacker to elevate their privileges.

The issue allows remote attackers to affect confidentiality, integrity, and availability. It is related to the installation process and may involve an untrusted search path that allows local users to gain privileges via a Trojan horse dll in the application directory. The vulnerability can also be exploited to download arbitrary files by sending a link to them during application installation.

The issue affects confidentiality, integrity, and availability. It is related to unknown vectors and the Windows Installer. There are claims that this could be an untrusted search path issue, potentially allowing local users to gain privileges via a Trojan horse dll in the application directory.

The issue allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory. This can be demonstrated by a directory that contains a .bat or .cmd file. The vulnerability is related to the handling of .bat and .cmd files launched from an external network, which can be exploited to gain full control over the system. This allows an attacker to install programs, view, modify, or delete data, and create new accounts with full user rights. Users with limited system rights are less exposed to this issue than users working with administrator rights.

The issue is related to an untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library, which allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory during execution of an MFC application. This can be demonstrated by a directory that contains a TRC, cur, rs, rct, or res file. A remote code execution vulnerability also exists in the way that certain applications built with Microsoft Foundation Classes (MFC) handle the loading of DLL files, potentially allowing an attacker to take complete control of an affected system.

The issue is related to errors in processing files with .LNK (or .PIF) extensions. Exploitation of this issue can allow a remote attacker to execute arbitrary code using a specially crafted .LNK (or .PIF) file. This can occur when Windows Explorer improperly handles icon display for such files. The issue has been demonstrated in the wild and was originally reported for malware leveraging vulnerabilities in Siemens WinCC SCADA systems. An estimated number of affected devices is not provided, but the issue has been observed in real-world incidents. Technical details include the exploitation of `Windows Shell` in Microsoft Windows, where a crafted (1) `.LNK` or (2) `.PIF` shortcut file is not properly handled during icon display.

Name of the Vulnerable Software and Affected Versions: Clam AntiVirus (ClamAV) versions prior to 0.86.1 Description: The issue allows remote attackers to cause a denial of service, resulting in an application crash, by providing a crafted Quantum archive. Recommendations: For versions prior to 0.86.1, update to version 0.86.1 or later to resolve the issue.