ID
VAR-202101-1014
CVE
CVE-2021-1240
TITLE
Windows for Cisco Proximity Desktop Vulnerability in Uncontrolled Search Path Elements
Trust: 0.8
DESCRIPTION
A vulnerability in the loading process of specific DLLs in Cisco Proximity Desktop for Windows could allow an authenticated, local attacker to load a malicious library. To exploit this vulnerability, the attacker must have valid credentials on the Windows system. This vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file in a specific location on the targeted system. This file will execute when the vulnerable application launches. A successful exploit could allow the attacker to execute arbitrary code on the targeted system with the privileges of another user’s account. Desk is a writing, blogging and note-taking app by an individual developer. Microsoft Windows is a desktop operating system of Microsoft Corporation in the United States
Trust: 1.8
AFFECTED PRODUCTS
| vendor: | cisco | model: | proximity | scope: | lt | version: | 3.1.0 | Trust: 1.0 |
| vendor: | シスコシステムズ | model: | cisco proximity | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | シスコシステムズ | model: | cisco proximity | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-427 | Trust: 1.1 |
| problemtype: | Uncontrolled search path elements (CWE-427) [NVD Evaluation ] | Trust: 0.8 |
THREAT TYPE
local
Trust: 0.6
TYPE
code problem
Trust: 0.6
PATCH
| title: | cisco-sa-proximity-dll-UvW4VHPM | url: | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-proximity-dll-UvW4VHPM | Trust: 0.8 |
| title: | Cisco Proximity Desktop for Windows Fixes for code issue vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=139474 | Trust: 0.6 |
| title: | Cisco: Cisco Proximity Desktop for Windows DLL Hijacking Vulnerability | url: | https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-proximity-dll-UvW4VHPM | Trust: 0.1 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-1240 | Trust: 2.6 |
| db: | JVNDB | id: | JVNDB-2021-002767 | Trust: 0.8 |
| db: | AUSCERT | id: | ESB-2021.0144 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202101-967 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-374294 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2021-1240 | Trust: 0.1 |
REFERENCES
| url: | https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-proximity-dll-uvw4vhpm | Trust: 2.5 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-1240 | Trust: 1.4 |
| url: | https://www.auscert.org.au/bulletins/esb-2021.0144/ | Trust: 0.6 |
| url: | https://cwe.mitre.org/data/definitions/427.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | VULHUB | id: | VHN-374294 |
| db: | VULMON | id: | CVE-2021-1240 |
| db: | JVNDB | id: | JVNDB-2021-002767 |
| db: | CNNVD | id: | CNNVD-202101-967 |
| db: | NVD | id: | CVE-2021-1240 |
LAST UPDATE DATE
2024-11-23T22:44:17.862000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-374294 | date: | 2021-01-20T00:00:00 |
| db: | VULMON | id: | CVE-2021-1240 | date: | 2021-01-20T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-002767 | date: | 2021-09-30T08:51:00 |
| db: | CNNVD | id: | CNNVD-202101-967 | date: | 2021-01-21T00:00:00 |
| db: | NVD | id: | CVE-2021-1240 | date: | 2024-11-21T05:43:54.273 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-374294 | date: | 2021-01-13T00:00:00 |
| db: | VULMON | id: | CVE-2021-1240 | date: | 2021-01-13T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-002767 | date: | 2021-09-30T00:00:00 |
| db: | CNNVD | id: | CNNVD-202101-967 | date: | 2021-01-13T00:00:00 |
| db: | NVD | id: | CVE-2021-1240 | date: | 2021-01-13T22:15:20.897 |