CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.3 | $0-$5k | 0.00 |
A vulnerability was found in ESTsoft ALZip up to 10.75. It has been classified as critical. Affected is an unknown function of the component DLL Handler. The manipulation with an unknown input leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:
ESTsoft ALZip before 10.76 allows local users to execute arbitrary code via creating a malicious .DLL file and installing it in a specific directory: %PROGRAMFILES%\ESTsoft\ALZip\Formats, %PROGRAMFILES%\ESTsoft\ALZip\Coders, %PROGRAMFILES(X86)%\ESTsoft\ALZip\Formats, or %PROGRAMFILES(X86)%\ESTsoft\ALZip\Coders.
The bug was discovered 05/17/2018. The weakness was disclosed 05/17/2018 (Website). The advisory is shared for download at pastebin.com. This vulnerability is traded as CVE-2018-10027 since 04/11/2018. The attack needs to be approached locally. The successful exploitation requires a authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1574.
Upgrading to version 10.76 eliminates this vulnerability.
Product
Vendor
Name
Version
- 10.0
- 10.1
- 10.2
- 10.3
- 10.4
- 10.5
- 10.6
- 10.7
- 10.8
- 10.9
- 10.10
- 10.11
- 10.12
- 10.13
- 10.14
- 10.15
- 10.16
- 10.17
- 10.18
- 10.19
- 10.20
- 10.21
- 10.22
- 10.23
- 10.24
- 10.25
- 10.26
- 10.27
- 10.28
- 10.29
- 10.30
- 10.31
- 10.32
- 10.33
- 10.34
- 10.35
- 10.36
- 10.37
- 10.38
- 10.39
- 10.40
- 10.41
- 10.42
- 10.43
- 10.44
- 10.45
- 10.46
- 10.47
- 10.48
- 10.49
- 10.50
- 10.51
- 10.52
- 10.53
- 10.54
- 10.55
- 10.56
- 10.57
- 10.58
- 10.59
- 10.60
- 10.61
- 10.62
- 10.63
- 10.64
- 10.65
- 10.66
- 10.67
- 10.68
- 10.69
- 10.70
- 10.71
- 10.72
- 10.73
- 10.74
- 10.75
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.5VulDB Meta Temp Score: 6.4
VulDB Base Score: 5.3
VulDB Temp Score: 5.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 7.8
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Untrusted search pathCWE: CWE-426
CAPEC: 🔍
ATT&CK: 🔍
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Upgrade: ALZip 10.76
Timeline
04/11/2018 🔍05/17/2018 🔍
05/17/2018 🔍
05/17/2018 🔍
05/17/2018 🔍
02/06/2020 🔍
Sources
Advisory: pastebin.comStatus: Not defined
CVE: CVE-2018-10027 (🔍)
Entry
Created: 05/17/2018 22:22Updated: 02/06/2020 11:29
Changes: 05/17/2018 22:22 (58), 02/06/2020 11:29 (1)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.