NSClient++ up to 0.4.1.72 program.exe Search Path unquoted search path

Summaryinfo

A vulnerability was found in NSClient++ up to 0.4.1.72. It has been rated as problematic. This impacts an unknown function of the file program.exe. This manipulation as part of Search Path causes unquoted search path. This vulnerability appears as CVE-2018-6384. The attack requires local access. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in NSClient++ up to 0.4.1.72 and classified as problematic. Affected by this vulnerability is an unknown function of the file program.exe. The manipulation as part of a Search Path leads to a unquoted search path vulnerability. The CWE definition for the vulnerability is CWE-428. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Unquoted Windows search path vulnerability in NSClient++ before 0.4.1.73 allows non-privileged local users to execute arbitrary code with elevated privileges on the system via a malicious program.exe executable in the %SYSTEMDRIVE% folder.

The bug was discovered 01/30/2018. The weakness was presented 01/31/2018 (Website). The advisory is shared at nsclient.org. This vulnerability is known as CVE-2018-6384 since 01/29/2018. An attack has to be approached locally. The successful exploitation requires a single authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1574.009 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 0.4.1.73 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• NSClient++

Version

• 0.4.1.0
• 0.4.1.1
• 0.4.1.2
• 0.4.1.3
• 0.4.1.4
• 0.4.1.5
• 0.4.1.6
• 0.4.1.7
• 0.4.1.8
• 0.4.1.9
• 0.4.1.10
• 0.4.1.11
• 0.4.1.12
• 0.4.1.13
• 0.4.1.14
• 0.4.1.15
• 0.4.1.16
• 0.4.1.17
• 0.4.1.18
• 0.4.1.19
• 0.4.1.20
• 0.4.1.21
• 0.4.1.22
• 0.4.1.23
• 0.4.1.24
• 0.4.1.25
• 0.4.1.26
• 0.4.1.27
• 0.4.1.28
• 0.4.1.29
• 0.4.1.30
• 0.4.1.31
• 0.4.1.32
• 0.4.1.33
• 0.4.1.34
• 0.4.1.35
• 0.4.1.36
• 0.4.1.37
• 0.4.1.38
• 0.4.1.39
• 0.4.1.40
• 0.4.1.41
• 0.4.1.42
• 0.4.1.43
• 0.4.1.44
• 0.4.1.45
• 0.4.1.46
• 0.4.1.47
• 0.4.1.48
• 0.4.1.49
• 0.4.1.50
• 0.4.1.51
• 0.4.1.52
• 0.4.1.53
• 0.4.1.54
• 0.4.1.55
• 0.4.1.56
• 0.4.1.57
• 0.4.1.58
• 0.4.1.59
• 0.4.1.60
• 0.4.1.61
• 0.4.1.62
• 0.4.1.63
• 0.4.1.64
• 0.4.1.65
• 0.4.1.66
• 0.4.1.67
• 0.4.1.68
• 0.4.1.69
• 0.4.1.70
• 0.4.1.71
• 0.4.1.72

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion