CVE-2019-7323 - GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update

Back Back to CVE browser

HIGH

GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update

Published Feb 4, 2019

7.5

HIGH

CVSS 3.0

EPSS 1.08%

Description

GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update. The update process relies on cleartext HTTP. The attacker could replace the LogMXUpdater.class file.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-345

References (4)

https://bmantra.github.io/logmx/logmx.html
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-16866
Advisory
https://github.com/bmantra/bmantra.github.io/blob/master/logmx/logmx.html
x_refsource_MISCExploitThird Party Advisory
https://logmx.com/download
x_refsource_MISCPatchRelease NotesThird Party Advisory

Link	Providers	Tags
https://bmantra.github.io/logmx/logmx.html		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-16866		Advisory
https://github.com/bmantra/bmantra.github.io/blob/master/logmx/logmx.html		x_refsource_MISCExploitThird Party Advisory
https://logmx.com/download		x_refsource_MISCPatchRelease NotesThird Party Advisory