CVE-2017-9046

winpm-32.exe in Pegasus Mail (aka Pmail) v4.72 build 572 allows code execution via a crafted ssgp.dll file that must be installed locally. For example, if ssgp.dll is on the desktop and executes arbitrary code in the DllMain function, then clicking on a mailto: link on a remote web page triggers the attack.

CVSS v3 7.3 HIGH
CVSS v2.0 4.4 MEDIUM

7.3^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://packetstormsecurity.com/files/142606/Pegasus-4.72-Build-572-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
https://packetstormsecurity.com/files/142606/Pegasus-4.72-Build-572-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:pmail:pegasus:4.72:*:*:*:*:*:*:*

History

21 Nov 2024, 03:35

Type	Values Removed	Values Added
References	~~() https://packetstormsecurity.com/files/142606/Pegasus-4.72-Build-572-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry~~	() https://packetstormsecurity.com/files/142606/Pegasus-4.72-Build-572-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry

Information

Published : 2017-05-21 14:29

Updated : 2024-11-21 03:35

NVD link : CVE-2017-9046

Mitre link : CVE-2017-9046

CVE.ORG link : CVE-2017-9046

JSON object : View

Products Affected

pmail

pegasus

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2017-9046", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "published": "2017-05-21T14:29:00.260", "references": [{"url": "https://packetstormsecurity.com/files/142606/Pegasus-4.72-Build-572-Remote-Code-Execution.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://packetstormsecurity.com/files/142606/Pegasus-4.72-Build-572-Remote-Code-Execution.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "winpm-32.exe in Pegasus Mail (aka Pmail) v4.72 build 572 allows code execution via a crafted ssgp.dll file that must be installed locally. For example, if ssgp.dll is on the desktop and executes arbitrary code in the DllMain function, then clicking on a mailto: link on a remote web page triggers the attack."}, {"lang": "es", "value": "El archivo winpm-32.exe en Pegasus Mail (tambi\u00e9n se conoce como Pmail) versi\u00f3n 4.72 build 572, permite la ejecuci\u00f3n de c\u00f3digo por medio de un archivo ssgp.dll dise\u00f1ado que debe instalarse localmente. Por ejemplo, si la biblioteca ssgp.dll est\u00e1 en el escritorio y ejecuta c\u00f3digo arbitrario en la funci\u00f3n DllMain, al hacer clic en un v\u00ednculo mailto: en una p\u00e1gina web remota se desencadena el ataque."}], "lastModified": "2024-11-21T03:35:12.760", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pmail:pegasus:4.72:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EB4AAA4-F496-4B2C-A8DD-5503E315EC17"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}