CVE-2014-1680: Medium severity Bandisoft Bandizip vulnerability
Published Feb 14, 2014
·Updated
Untrusted search path vulnerability in Bandisoft Bandizip before 3.10 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory.
Affected Software
10 affected components
Bandisoft Bandizip<=3.09
Bandisoft Bandizip=3.00
Bandisoft Bandizip=3.01
Bandisoft Bandizip=3.02
Bandisoft Bandizip=3.03
Bandisoft Bandizip=3.04
Bandisoft Bandizip=3.05
Bandisoft Bandizip=3.06
Bandisoft Bandizip=3.07
Bandisoft Bandizip=3.08
Event History
Feb 14, 2014
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Data Sourced
via NVD·01:10 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-1680?
CVE-2014-1680 has been classified as a high severity vulnerability due to the potential for privilege escalation.
2
How do I fix CVE-2014-1680?
To fix CVE-2014-1680, you should upgrade Bandisoft Bandizip to version 3.10 or later.
3
Who is affected by CVE-2014-1680?
CVE-2014-1680 affects all versions of Bandisoft Bandizip before 3.10, including versions 3.00 to 3.09.
4
What type of vulnerability is CVE-2014-1680?
CVE-2014-1680 is an untrusted search path vulnerability that can be exploited locally.
5
What could an attacker do with CVE-2014-1680?
An attacker could gain elevated privileges by placing a malicious dwmapi.dll file in the current working directory.