Druide Antidote RX/Antidote HD up to 8.05/9.5/10.1 Share Credentials access control

Summaryinfo

A vulnerability has been found in Druide Antidote RX and Antidote HD up to 8.05/9.5/10.1 and classified as problematic. This affects an unknown part of the component Share Handler. The manipulation leads to access control (Credentials). This vulnerability is traded as CVE-2019-9565. Access to the local network is required for this attack to succeed. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Druide Antidote RX and Antidote HD up to 8.05/9.5/10.1. It has been rated as problematic. This issue affects an unknown part of the component Share Handler. The manipulation with an unknown input leads to a access control vulnerability (Credentials). Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality. The summary by CVE is:

Druide Antidote RX, HD, 8 before 8.05.2287, 9 before 9.5.3937 and 10 before 10.1.2147 allows remote attackers to steal NTLM hashes or perform SMB relay attacks upon a direct launch of the product, or upon an indirect launch via an integration such as Chrome, Firefox, Word, Outlook, etc. This occurs because the product attempts to access a share with the PLUG-INS subdomain name; an attacker may be able to use Active Directory Domain Services to register that name.

The bug was discovered 02/20/2019. The weakness was shared 03/04/2019. The identification of this vulnerability is CVE-2019-9565 since 03/04/2019. The attack needs to be done within the local network. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 12 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 8.05.2287, 9.5.3937 or 10.1.2147 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Druide

Name

• Antidote HD
• Antidote RX

Version

• 8.05
• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 10.0
• 10.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion