SecurEnvoy SecurAccess内存破坏漏洞

CVE编号

CVE-2018-18466

利用情况

暂无

补丁情况

N/A

披露时间

2019-03-22

漏洞描述

** DISPUTED ** An issue was discovered in SecurEnvoy SecurAccess 9.3.502. When put in Debug mode and used for RDP connections, the application stores the emergency credentials in cleartext in the logs (present in the DEBUG folder) that can be accessed by anyone. NOTE: The vendor disputes this as a vulnerability since the disclosure of a local account password (actually an alpha numeric passcode) is achievable only when a custom registry key is added to the windows registry. This action requires administrator access and the registry key is only provided by support staff at securenvoy to troubleshoot customer issues.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://www.excellium-services.com/cert-xlm-advisory/cve-2018-18466/

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	securenvoy	securaccess	9.3.502	-

CVSS3评分 7.0

• 攻击路径 本地
• 攻击复杂度 高
• 权限要求 低
• 影响范围 未更改
• 用户交互 无
• 可用性 高
• 保密性 高
• 完整性 高

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-ID 漏洞类型 CWE-532 通过日志文件的信息暴露