CVSS: 7.0EPSS: 0%CPEs: 1EXPL: 3CVE-2019-18988 – TeamViewer Desktop Bypass Remote Login Vulnerability
https://notcve.org/view.php?id=CVE-2019-18988
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions before v9.x , this allowed for attackers to decrypt the Unattended Access password to the system (which allows for remote login to the system as well as headless file browsing). The latest version still uses the same key for OptionPasswordAES but appears to have changed how the Unattended Access password is stored. • https://github.com/mr-r3b00t/CVE-2019-18988 https://github.com/reversebrain/CVE-2019-18988 https://community.teamviewer.com/t5/Announcements/Specification-on-CVE-2019-18988/td-p/82264 https://community.teamviewer.com/t5/Knowledge-Base/tkb-p/Knowledgebase?threadtype=label&labels=Security https://twitter.com/Blurbdust/status/1224212682594770946?s=20 https://whynotsecurity.com/blog/teamviewer - • CWE-521: Weak Password Requirements •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2019-19362
https://notcve.org/view.php?id=CVE-2019-19362
An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendor states that it was later fixed.) Upon login, every communication is saved within Windows main memory. When a user logs out or deletes conversation history (but does not exit the application), this data is not wiped from main memory, and therefore could be read by a local user with the same or greater privileges. Se detectó un problema en la funcionalidad Chat de la aplicación de escritorio TeamViewer versión 14.3.4730 en Windows. • http://nestedif.com/teamviewer-vulnerability-improper-session-handling-leading-to-information-disclosure-advisory • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 6.9EPSS: 0%CPEs: 5EXPL: 0CVE-2019-18196
https://notcve.org/view.php?id=CVE-2019-18196
A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed in 12.0.214399), 13.2.36215 (fixed in 13.2.36216), and 14.6.4835 (fixed in 14.7.1965) on Windows could allow an attacker to perform code execution on a target system via a service restart where the DLL was previously installed with administrative privileges. Exploitation requires that an attacker be able to create a new file in the TeamViewer application directory; directory permissions restrict that by default. Una vulnerabilidad de carga lateral de DLL en el Windows Service en TeamViewer versiones hasta 11.0.133222 (corregido en 11.0.214397), 12.0.181268 (corregido en 12.0.214399), 13.2.36215 (corregido en 13.2.36216) y 14.6.4835 (corregido en 14.7.1965) sobre Windows, podría permitir a un atacante llevar a cabo la ejecución de código en un sistema de destino mediante un reinicio del servicio donde la DLL fue instalada previamente con privilegios administrativos. La explotación requiere que un atacante sea capaz de crear un nuevo archivo en el directorio de la aplicación TeamViewer; los permisos de directorio restringen eso por defecto. • https://community.teamviewer.com/t5/Announcements/Security-bulletin-CVE-2019-18196/td-p/74564 https://safebreach.com/Post/TeamViewer-Windows-Client-v11-to-v14-DLL-Preloading-and-Potential-Abuses-CVE-2019-18196 • CWE-426: Untrusted Search Path •