PT-2015-4975

CVE-2015-0925

Published

2015-01-22

Updated

2015-01-24

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions iPass Open Mobile versions prior to 2.4.5

Description The issue allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string. This is due to improper handling by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.

Recommendations For versions prior to 2.4.5, update to version 2.4.5 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Matthias Kaiser

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers