Tenable Nessus 5.2.1 Process Detection Plugin ID 59275 mi_malware_scan.nbin race condition

CVSS Meta Temp Score
CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.
Current Exploit Price (≈)
Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.
CTI Interest Score
Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
5.2$0-$5k0.00

Summaryinfo

A vulnerability labeled as problematic has been found in Tenable Nessus 5.2.1. This affects an unknown function of the file mi_malware_scan.nbin of the component Process Detection Plugin ID 59275. Such manipulation leads to race condition. This vulnerability is referenced as CVE-2014-2848. No exploit is available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Tenable Nessus 5.2.1 (Security Testing Software). It has been rated as problematic. Affected by this issue is an unknown part of the file mi_malware_scan.nbin of the component Process Detection Plugin ID 59275. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local users to gain privileges by replacing the dissolvable agent executable in the Windows temp directory with a Trojan horse program.

The bug was discovered 01/29/2014. The weakness was published 03/20/2014 by Neil Jones as NGS00643 / RWZ-21387-181 as confirmed posting (Website). The advisory is shared for download at nccgroup.com. The public release has been coordinated with the vendor. This vulnerability is handled as CVE-2014-2848 since 04/11/2014. The attack needs to be approached locally. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The advisory points out:

A service was then created to run this binary, the service created was set to automatically start upon boot. As a low level user the binary should be created before the scan, once the scan is in progress the binary is overwritten by the Nessus plugin, once the Nessus plugin overwrites the binary the low level user can once again overwrite the binary the machine can be rebooted by the low level user so the binary is automatically ran upon system boot.

The vulnerability was handled as a non-public zero-day exploit for at least 36 days. During that time the estimated underground price was around $5k-$25k.

Applying a patch is able to eliminate this problem. A possible mitigation has been published before and not just after the disclosure of the vulnerability. The posting contains the following remark:

The plugin has been updated and the vulnerability can be patched by updating the plugins on your scanner

The vulnerability is also documented in the databases at X-Force (92095), SecurityFocus (BID 66368†), Secunia (SA57403†) and SecurityTracker (ID 1029946†). Similar entry is available at VDB-69305. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

  • Nessus Plugin Set 201402092115

Productinfo

Type

Vendor

Name

Version

License

CPE 2.3info

CPE 2.2info

CVSSv4info

VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv3info

VulDB Meta Base Score: 5.9
VulDB Meta Temp Score: 5.2

VulDB Base Score: 5.9
VulDB Temp Score: 5.2
VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv2info

AVACAuCIA
💳💳💳💳💳💳
💳💳💳💳💳💳
💳💳💳💳💳💳
VectorComplexityAuthenticationConfidentialityIntegrityAvailability
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

NVD Base Score: 🔍

Exploitinginfo

Class: Race condition
CWE: CWE-362
CAPEC: 🔍
ATT&CK: 🔍

Physical: Partially
Local: Yes
Remote: No

Availability: 🔍
Status: Unproven

EPSS Score: 🔍
EPSS Percentile: 🔍

Price Prediction: 🔍
Current Price Estimation: 🔍

0-DayUnlockUnlockUnlockUnlock
TodayUnlockUnlockUnlockUnlock

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Patch
Status: 🔍

Reaction Time: 🔍
0-Day Time: 🔍

Timelineinfo

01/29/2014 🔍
02/18/2014 +20 days 🔍
03/06/2014 +16 days 🔍
03/20/2014 +14 days 🔍
03/21/2014 +1 days 🔍
03/21/2014 +0 days 🔍
03/24/2014 +3 days 🔍
03/27/2014 +3 days 🔍
04/11/2014 +15 days 🔍
04/11/2014 +0 days 🔍
05/10/2026 +4412 days 🔍

Sourcesinfo

Advisory: NGS00643 / RWZ-21387-181
Researcher: Neil Jones
Status: Confirmed
Confirmation: 🔍
Coordinated: 🔍

CVE: CVE-2014-2848 (🔍)
GCVE (CVE): GCVE-0-2014-2848
GCVE (VulDB): GCVE-100-12680
X-Force: 92095 - Nessus mi_malware_scan.nbin privilege escalation, Medium Risk
SecurityFocus: 66368 - Nessus 'mi_malware_scan.nbin' Plugin Local Privilege Escalation Vulnerability
Secunia: 57403 - Nessus wmi_malware_scan.nbin Plugin Privilege Escalation Vulnerability, Less Critical
SecurityTracker: 1029946

scip Labs: https://www.scip.ch/en/?labs.20091204
See also: 🔍

Entryinfo

Created: 03/24/2014 13:25
Updated: 05/10/2026 12:23
Changes: 03/24/2014 13:25 (80), 03/18/2019 19:41 (1), 05/10/2026 12:23 (17)
Complete: 🔍
Cache ID: 216::103

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion

No comments yet. Languages: en.

Please log in to comment.

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!