A vulnerability, which was classified as critical, was found in Agrinsoft Argin All Dvd Ripper 4.0. This affects an unknown code in the library wnaspi32.dll. The manipulation with an unknown input leads to a local privilege escalation vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Untrusted search path vulnerability in Agrin All DVD Ripper 4.0 allows local users to gain privileges via a Trojan horse wnaspi32.dll file in the current working directory, as demonstrated by a directory that contains a .ifo file. NOTE: some of these details are obtained from third party information.

The weakness was disclosed 09/07/2012 (Website). The advisory is shared at exploit-db.com. This vulnerability is uniquely identified as CVE-2010-5260 since 09/07/2012. An attack has to be approached locally. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1574 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Secunia (SA41497†). The entries VDB-54727, VDB-62158, VDB-62067 and VDB-62066 are pretty similar.

Productinfo

Vendor

• Agrinsoft

Name

• Argin All Dvd Ripper

Version

• 4.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion