DeviceLock Plug/Play Auditor 5.72 Unicode DLPnpAuditor.exe memory corruption

Summaryinfo

A vulnerability has been found in DeviceLock Plug and Play Auditor 5.72 and classified as critical. The impacted element is an unknown function of the file DLPnpAuditor.exe of the component Unicode Handler. The manipulation leads to memory corruption. This vulnerability is referenced as CVE-2018-10655. The attack can only be performed from a local environment. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in DeviceLock Plug and Play Auditor 5.72. It has been rated as critical. This issue affects an unknown part of the file DLPnpAuditor.exe of the component Unicode Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

DLPnpAuditor.exe in DeviceLock Plug and Play Auditor (freeware) 5.72 has a Unicode Buffer Overflow (SEH).

The bug was discovered 05/07/2018. The weakness was published 05/10/2018 as EDB-ID 44590 as not defined exploit (Exploit-DB). It is possible to read the advisory at exploit-db.com. The identification of this vulnerability is CVE-2018-10655 since 05/02/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known.

After immediately, there has been an exploit disclosed. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (44590). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• DeviceLock

Name

• Play Auditor
• Plug

Version

• 5.72

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion