A vulnerability classified as critical has been found in DATEV DATEV Grundpaket Basis Cd23.20. Affected is an unknown code block in the library DVBSKNLANG101.dll of the file DMTGUI2.EXE. The manipulation with an unknown input leads to a local privilege escalation vulnerability. CWE is classifying the issue as CWE-426. The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Multiple untrusted search path vulnerabilities in the DMTGUI2.EXE and DvInesLogFileViewer.Exe components in DATEV Grundpaket Basis CD23.20 allow local users to gain privileges via a Trojan horse (1) DVBSKNLANG101.dll or (2) DvZediTermSrvInfo004.dll file in the current working directory, as demonstrated by a directory that contains a .dmt, .adl, .c02, .dof, or .jrf file. NOTE: some of these details are obtained from third party information.

The weakness was disclosed 09/07/2012 (Website). The advisory is shared for download at sotiriu.de. This vulnerability is traded as CVE-2011-5158 since 09/07/2012. The attack needs to be approached locally. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1574.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Vendor

• DATEV

Name

• DATEV Grundpaket Basis

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion