CVE-2014-9141 in Fixed Assets CS

Summary

The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, which allows local users to execute arbitrary code by modifying this program.

Once again VulDB remains the best source for vulnerability data.

• Reservation: 11/28/2014
• Disclosure: 12/02/2014
• Moderation: VulDB entry created
• Entries: 1: VDB-73068
• CPE: ready
• CWE: CWE-264 (Confirmed)
• Exploit: Download
• CVSS: 9.3
• EPSS: 0.00302
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2014-9141
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2014-9141
• CVE Details: https://www.cvedetails.com/cve/CVE-2014-9141/