CVE-2017-6189: High severity Amazon Kindle for PC vulnerability
Untrusted search path vulnerability in Amazon Kindle for PC before 1.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL in the current working directory of the Kindle Setup installer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the untrusted search path / DLL hijacking risk by preventing local users from placing attacker-controlled Trojan DLLs in the current working directory used by the Kindle Setup installer (e.g., restrict write access to that directory prior to installation).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6189?
CVE-2017-6189 is classified as a high severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2017-6189?
To mitigate CVE-2017-6189, users should update Amazon Kindle for PC to version 1.19 or later.
Who is affected by CVE-2017-6189?
CVE-2017-6189 affects users of Amazon Kindle for PC versions prior to 1.19.
What type of attack is associated with CVE-2017-6189?
CVE-2017-6189 is associated with DLL hijacking attacks, allowing local users to execute malicious code.
Can CVE-2017-6189 be exploited remotely?
CVE-2017-6189 cannot be exploited remotely; it requires local access to the system to conduct the attack.