Vulnerability-Lookup

CNVD-2018-06260

Vulnerability from cnvd - Published: 2018-03-26

Title

Malwarebytes Anti-Malware consumer存在未明漏洞

Description

Malwarebytes Anti-Malware consumer是美国Malwarebytes公司的一套反恶意间谍软件。该软件支持删除蠕虫、拨号程序、木马、rootkit、间谍软件、漏洞、僵尸和其他恶意软件等。 Malwarebytes Anti-Malware consumer中的encryption和permission实现存在安全漏洞。攻击者可利用该漏洞控制白名单功能，运行未授权的应用程序（恶意软件和网站），执行并访问被列入黑名单的文件和域。

Severity

中

Patch Name

Malwarebytes Anti-Malware consumer存在未明漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： https://www.malwarebytes.com/

Reference

http://www.securitytube.net/video/16690

Impacted products

Name
Malwarebytes Anti-Malware consumer <=2.2.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-10717"
    }
  },
  "description": "Malwarebytes Anti-Malware consumer\u662f\u7f8e\u56fdMalwarebytes\u516c\u53f8\u7684\u4e00\u5957\u53cd\u6076\u610f\u95f4\u8c0d\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u652f\u6301\u5220\u9664\u8815\u866b\u3001\u62e8\u53f7\u7a0b\u5e8f\u3001\u6728\u9a6c\u3001rootkit\u3001\u95f4\u8c0d\u8f6f\u4ef6\u3001\u6f0f\u6d1e\u3001\u50f5\u5c38\u548c\u5176\u4ed6\u6076\u610f\u8f6f\u4ef6\u7b49\u3002\r\n\r\nMalwarebytes Anti-Malware consumer\u4e2d\u7684encryption\u548cpermission\u5b9e\u73b0\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63a7\u5236\u767d\u540d\u5355\u529f\u80fd\uff0c\u8fd0\u884c\u672a\u6388\u6743\u7684\u5e94\u7528\u7a0b\u5e8f\uff08\u6076\u610f\u8f6f\u4ef6\u548c\u7f51\u7ad9\uff09\uff0c\u6267\u884c\u5e76\u8bbf\u95ee\u88ab\u5217\u5165\u9ed1\u540d\u5355\u7684\u6587\u4ef6\u548c\u57df\u3002",
  "discovererName": "unknown",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://www.malwarebytes.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-06260",
  "openTime": "2018-03-26",
  "patchDescription": "Malwarebytes Anti-Malware consumer\u662f\u7f8e\u56fdMalwarebytes\u516c\u53f8\u7684\u4e00\u5957\u53cd\u6076\u610f\u95f4\u8c0d\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u652f\u6301\u5220\u9664\u8815\u866b\u3001\u62e8\u53f7\u7a0b\u5e8f\u3001\u6728\u9a6c\u3001rootkit\u3001\u95f4\u8c0d\u8f6f\u4ef6\u3001\u6f0f\u6d1e\u3001\u50f5\u5c38\u548c\u5176\u4ed6\u6076\u610f\u8f6f\u4ef6\u7b49\u3002\r\n\r\nMalwarebytes Anti-Malware consumer\u4e2d\u7684encryption\u548cpermission\u5b9e\u73b0\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63a7\u5236\u767d\u540d\u5355\u529f\u80fd\uff0c\u8fd0\u884c\u672a\u6388\u6743\u7684\u5e94\u7528\u7a0b\u5e8f\uff08\u6076\u610f\u8f6f\u4ef6\u548c\u7f51\u7ad9\uff09\uff0c\u6267\u884c\u5e76\u8bbf\u95ee\u88ab\u5217\u5165\u9ed1\u540d\u5355\u7684\u6587\u4ef6\u548c\u57df\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Malwarebytes Anti-Malware consumer\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Malwarebytes Anti-Malware consumer \u003c=2.2.1"
  },
  "referenceLink": "http://www.securitytube.net/video/16690",
  "serverity": "\u4e2d",
  "submitTime": "2018-03-23",
  "title": "Malwarebytes Anti-Malware consumer\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}

CVE-2016-10717 (GCVE-0-2016-10717)

Vulnerability from cvelistv5 – Published: 2018-03-21 21:00 – Updated: 2024-08-06 03:30

Summary

A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can be executed, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

5 references

URL	Tags
https://www.youtube.com/watch?v=LF5ic5nOoUY	x_refsource_MISC
http://www.securitytube.net/video/16690	x_refsource_MISC
https://github.com/mspaling/mbam-exclusions-poc-/…	x_refsource_MISC
https://github.com/mspaling/mbam-exclusions-poc-	x_refsource_MISC
https://forums.malwarebytes.com/topic/158251-malw…	x_refsource_MISC

Date Public

2018-03-21 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T03:30:20.307Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.youtube.com/watch?v=LF5ic5nOoUY"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securitytube.net/video/16690"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mspaling/mbam-exclusions-poc-/blob/master/mbam-whitelist-poc.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mspaling/mbam-exclusions-poc-"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-03-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can be executed, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-21T21:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.youtube.com/watch?v=LF5ic5nOoUY"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securitytube.net/video/16690"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mspaling/mbam-exclusions-poc-/blob/master/mbam-whitelist-poc.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mspaling/mbam-exclusions-poc-"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-10717",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can be executed, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.youtube.com/watch?v=LF5ic5nOoUY",
              "refsource": "MISC",
              "url": "https://www.youtube.com/watch?v=LF5ic5nOoUY"
            },
            {
              "name": "http://www.securitytube.net/video/16690",
              "refsource": "MISC",
              "url": "http://www.securitytube.net/video/16690"
            },
            {
              "name": "https://github.com/mspaling/mbam-exclusions-poc-/blob/master/mbam-whitelist-poc.txt",
              "refsource": "MISC",
              "url": "https://github.com/mspaling/mbam-exclusions-poc-/blob/master/mbam-whitelist-poc.txt"
            },
            {
              "name": "https://github.com/mspaling/mbam-exclusions-poc-",
              "refsource": "MISC",
              "url": "https://github.com/mspaling/mbam-exclusions-poc-"
            },
            {
              "name": "https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame/",
              "refsource": "MISC",
              "url": "https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-10717",
    "datePublished": "2018-03-21T21:00:00.000Z",
    "dateReserved": "2018-03-21T00:00:00.000Z",
    "dateUpdated": "2024-08-06T03:30:20.307Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2018-06260

CVE-2016-10717 (GCVE-0-2016-10717)

Tags

Sightings

Nomenclature

Related by attack behaviour