CVE-2015-8264
high
CVSS v3
7.8
CVSS v2
6.8
VIR risk
7.8
Description
Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as F-SecureOnlineScanner.exe.
Predictions
Exploit likelihood
75%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cret@cert.org — https://www.f-secure.com/en/web/labs_global/fsc-2015-4
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| f-secure | f-secure_online_scanner | - | |
References
- http://seclists.org/fulldisclosure/2016/Mar/64
- http://www.securityfocus.com/archive/1/537803/100/0/threaded
- http://www.securityfocus.com/bid/79657
- https://www.f-secure.com/en/web/labs_global/fsc-2015-4
- http://seclists.org/fulldisclosure/2016/Mar/64
- http://www.securityfocus.com/archive/1/537803/100/0/threaded
- http://www.securityfocus.com/bid/79657
- https://www.f-secure.com/en/web/labs_global/fsc-2015-4
CWEs
CWE-426
Verify integrity in audit chain (admin only). AS-IS.