Sony Catalyst Production Suite/Catalyst Browse up to 1.1.0.21 DLL Loader untrusted search path

Summaryinfo

A vulnerability, which was classified as critical, was found in Sony Catalyst Production Suite and Catalyst Browse up to 1.1.0.21. The affected element is an unknown function of the component DLL Loader. Executing a manipulation can lead to untrusted search path. This vulnerability is registered as CVE-2019-19364. The attack needs to be launched locally. No exploit is available.

Detailsinfo

A vulnerability was found in Sony Catalyst Production Suite and Catalyst Browse up to 1.1.0.21. It has been declared as critical. This vulnerability affects some unknown functionality of the component DLL Loader. The manipulation with an unknown input leads to a untrusted search path vulnerability. The CWE definition for the vulnerability is CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In Sony Catalyst Production Suite through 2019.1 (1.1.0.21) and Catalyst Browse through 2019.1 (1.1.0.21), an unprivileged user can obtain admin privileges, and execute a program as admin, after DLL hijacking of a DLL that is loaded during setup (installation).

The weakness was published 12/04/2019. This vulnerability was named CVE-2019-19364 since 11/27/2019. The attack needs to be approached locally. A single authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 03/07/2024). The MITRE ATT&CK project declares the attack technique as T1574.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Sony

Name

• Catalyst Browse
• Catalyst Production Suite

Version

• 1.1.0.0
• 1.1.0.1
• 1.1.0.2
• 1.1.0.3
• 1.1.0.4
• 1.1.0.5
• 1.1.0.6
• 1.1.0.7
• 1.1.0.8
• 1.1.0.9
• 1.1.0.10
• 1.1.0.11
• 1.1.0.12
• 1.1.0.13
• 1.1.0.14
• 1.1.0.15
• 1.1.0.16
• 1.1.0.17
• 1.1.0.18
• 1.1.0.19
• 1.1.0.20
• 1.1.0.21

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion