Input validation error in KDE kmplayer



| Updated: 2020-08-11
Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2012-3841
CWE-ID CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
 kmplayer
Other
Vendor KDE.org

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Input validation error

EUVDB-ID: #VU43915

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2012-3841

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Untrusted search path vulnerability in KMPlayer 3.2.0.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ehtrace.dll that is located in the current working directory. Per indicated reference links 1182120 and 1182121, the attack can be leveraged remotely has been scored as such pending clarification of CVE description.

Mitigation

Install update from vendor's website.

Vulnerable software versions

kmplayer: 3.2.0.19

CPE2.3 External links

https://osvdb.org/81558
https://packetstormsecurity.org/files/112218/KMPlayer-3.2.0.19-DLL-Hijack.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/75193


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###