Details of VAR-201708-1065

ID

VAR-201708-1065

CVE

CVE-2017-11160

TITLE

Windows Run on Synology Assistant Vulnerabilities related to untrusted search paths

Trust: 0.8

sources: JVNDB: JVNDB-2017-007345

DESCRIPTION

Multiple untrusted search path vulnerabilities in installer in Synology Assistant before 6.1-15163 on Windows allows local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory. Windows Run on Synology Assistant Contains an unreliable search path vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Synology Assistant on Windows is a Windows-based installation assistant from Synology. installer is one of the installers. An untrusted search path vulnerability exists in the installer of Synology Assistant versions earlier than 6.1-15163 on Windows platforms

Trust: 1.71

sources: NVD: CVE-2017-11160 // JVNDB: JVNDB-2017-007345 // VULHUB: VHN-101555

AFFECTED PRODUCTS

vendor:	synology	model:	assistant	scope:	lte	version:	6.1-15030	Trust: 1.0
vendor:	synology	model:	assistant	scope:	lt	version:	6.1-15163	Trust: 0.8
vendor:	synology	model:	assistant	scope:	eq	version:	6.1-15030	Trust: 0.6

sources: JVNDB: JVNDB-2017-007345 // CNNVD: CNNVD-201707-373 // NVD: CVE-2017-11160

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-11160
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-11160
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201707-373
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-101555
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-11160
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-101555
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-11160
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-101555 // JVNDB: JVNDB-2017-007345 // CNNVD: CNNVD-201707-373 // NVD: CVE-2017-11160

PROBLEMTYPE DATA

problemtype:

CWE-426

Trust: 1.9

sources: VULHUB: VHN-101555 // JVNDB: JVNDB-2017-007345 // NVD: CVE-2017-11160

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201707-373

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201707-373

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-007345

PATCH

title:

Synology-SA-17:44 Synology Assistant

url:

https://www.synology.com/en-global/support/security/Synology_SA_17_44_Synology_Assistant

Trust: 0.8

sources: JVNDB: JVNDB-2017-007345

EXTERNAL IDS

db:	NVD	id:	CVE-2017-11160	Trust: 2.5
db:	JVNDB	id:	JVNDB-2017-007345	Trust: 0.8
db:	CNNVD	id:	CNNVD-201707-373	Trust: 0.7
db:	VULHUB	id:	VHN-101555	Trust: 0.1

sources: VULHUB: VHN-101555 // JVNDB: JVNDB-2017-007345 // CNNVD: CNNVD-201707-373 // NVD: CVE-2017-11160

REFERENCES

url:	https://www.synology.com/en-global/support/security/synology_sa_17_44_synology_assistant	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-11160	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-11160	Trust: 0.8

sources: VULHUB: VHN-101555 // JVNDB: JVNDB-2017-007345 // CNNVD: CNNVD-201707-373 // NVD: CVE-2017-11160

SOURCES

db:	VULHUB	id:	VHN-101555
db:	JVNDB	id:	JVNDB-2017-007345
db:	CNNVD	id:	CNNVD-201707-373
db:	NVD	id:	CVE-2017-11160

LAST UPDATE DATE

2025-04-20T23:32:06.182000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-101555	date:	2017-08-29T00:00:00
db:	JVNDB	id:	JVNDB-2017-007345	date:	2017-09-19T00:00:00
db:	CNNVD	id:	CNNVD-201707-373	date:	2017-08-21T00:00:00
db:	NVD	id:	CVE-2017-11160	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-101555	date:	2017-08-18T00:00:00
db:	JVNDB	id:	JVNDB-2017-007345	date:	2017-09-19T00:00:00
db:	CNNVD	id:	CNNVD-201707-373	date:	2017-07-11T00:00:00
db:	NVD	id:	CVE-2017-11160	date:	2017-08-18T19:29:00.183