SB2018122605 - Multiple vulnerabilities in Webroot BrightCloud SDK
Published: December 26, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Privilege escalation (CVE-ID: CVE-2018-4015)
The vulnerability allows a remote attacker to gain elevated privileges on the target system.
The vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK due to improper validation of TLS certificates when the configuration of the HTTP client does not enforce a secure connection by default. A remote attacker can use man-in-the-middle techniques to impersonate a remote BrightCloud server and gain elevated privileges.
2) Heap-based buffer overflow (CVE-ID: CVE-2018-4012)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK due to heap-based buffer overflow when the function bc_http_read_headerincorrectly handles overlong headers. A remote attacker can use man-in-the-middle techniques to impersonate a remote BrightCloud server, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Remediation
Install update from vendor's website.