NoMachine up to 5.3.26 wintab32.dll untrusted search path

Summaryinfo

A vulnerability identified as problematic has been detected in NoMachine up to 5.3.26. This vulnerability affects unknown code in the library wintab32.dll. Performing a manipulation results in untrusted search path. This vulnerability is reported as CVE-2018-17980. The attack requires a local approach. Moreover, an exploit is present. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in NoMachine up to 5.3.26. This affects some unknown functionality in the library wintab32.dll. The manipulation with an unknown input leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs file, as demonstrated by a scenario where the .nxs file and the DLL are in the current working directory, and the Trojan horse code is executed. (The directory could, in general, be on a local filesystem or a network share.).

The bug was discovered 10/12/2018. The weakness was disclosed 10/15/2018 (Website). The advisory is shared at nomachine.com. This vulnerability is uniquely identified as CVE-2018-17980 since 10/04/2018. An attack has to be approached locally. A authentication is required for exploitation. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1574 for this issue.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371274 (NoMachine Arbitrary Code Execution Vulnerability).

Upgrading to version 5.3.27 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (45611). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• NoMachine

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11
• 5.3.12
• 5.3.13
• 5.3.14
• 5.3.15
• 5.3.16
• 5.3.17
• 5.3.18
• 5.3.19
• 5.3.20
• 5.3.21
• 5.3.22
• 5.3.23
• 5.3.24
• 5.3.25
• 5.3.26

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion