CVE-2019-17334: TIBCO Spotfire Analyst and Desktop Remote Code Execution Via Shared Files
First published: Tue Dec 17 2019(Updated: )
The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop Language Packs contains a vulnerability that theoretically allows an attacker with permission to write DXP files to the Spotfire library to remotely execute code of their choice on the user account of other users who access the affected system. This attack is a risk only when the attacker has write access to a network file system shared with the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 7.11.1 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2, versions 10.4.0, 10.5.0, and 10.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0, TIBCO Spotfire Deployment Kit: versions 7.11.1 and below, TIBCO Spotfire Desktop: versions 7.11.1 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2, versions 10.4.0, 10.5.0, and 10.6.0, and TIBCO Spotfire Desktop Language Packs: versions 7.11.1 and below.
Credit: security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TIBCO Spotfire Analyst | <=7.11.1 | |
| TIBCO Spotfire Analyst | =7.12.0 | |
| TIBCO Spotfire Analyst | =7.13.0 | |
| TIBCO Spotfire Analyst | =7.14.0 | |
| TIBCO Spotfire Analyst | =10.0.0 | |
| TIBCO Spotfire Analyst | =10.1.0 | |
| TIBCO Spotfire Analyst | =10.2.0 | |
| TIBCO Spotfire Analyst | =10.3.0 | |
| TIBCO Spotfire Analyst | =10.3.1 | |
| TIBCO Spotfire Analyst | =10.3.2 | |
| TIBCO Spotfire Analyst | =10.4.0 | |
| TIBCO Spotfire Analyst | =10.5.0 | |
| TIBCO Spotfire Analyst | =10.6.0 | |
| TIBCO Spotfire Analytics Platform for AWS | =10.6.0 | |
| TIBCO Spotfire Deployment Kit | <=7.11.1 | |
| TIBCO Spotfire Desktop | <=7.11.1 | |
| TIBCO Spotfire Desktop | =7.12.0 | |
| TIBCO Spotfire Desktop | =7.13.0 | |
| TIBCO Spotfire Desktop | =7.14.0 | |
| TIBCO Spotfire Desktop | =10.0.0 | |
| TIBCO Spotfire Desktop | =10.1.0 | |
| TIBCO Spotfire Desktop | =10.2.0 | |
| TIBCO Spotfire Desktop | =10.3.0 | |
| TIBCO Spotfire Desktop | =10.3.1 | |
| TIBCO Spotfire Desktop | =10.3.2 | |
| TIBCO Spotfire Desktop | =10.4.0 | |
| TIBCO Spotfire Desktop | =10.5.0 | |
| TIBCO Spotfire Desktop | =10.6.0 | |
| TIBCO Spotfire Desktop Language Packs | <=7.11.1 |
Remedy
TIBCO has released updated versions of the affected components which address these issues. TIBCO Spotfire Analyst versions 7.11.1 and below update to version 7.11.2 or higher TIBCO Spotfire Analyst versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2 update to version 10.3.3 or higher TIBCO Spotfire Analyst versions 10.4.0, 10.5.0, and 10.6.0 update to version 10.6.1 or higher TIBCO Spotfire Analytics Platform for AWS Marketplace version 10.6.0 update to version 10.6.1 or higher TIBCO Spotfire Deployment Kit versions 7.11.1 and below update to version 7.11.2 or higher TIBCO Spotfire Desktop versions 7.11.1 and below update to version 7.11.2 or higher TIBCO Spotfire Desktop versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2 update to version 10.3.3 or higher TIBCO Spotfire Desktop versions 10.4.0, 10.5.0, and 10.6.0 update to version 10.6.1 or higher TIBCO Spotfire Desktop Language Packs versions 7.11.1 and below update to version 7.11.2 or higher
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-17334?
CVE-2019-17334 is a vulnerability in the Visualizations component of TIBCO Spotfire software.
What software versions are affected by CVE-2019-17334?
CVE-2019-17334 affects TIBCO Spotfire Analyst versions 7.11.1 to 10.6.0, TIBCO Spotfire Deployment Kit versions up to 7.11.1, TIBCO Spotfire Desktop versions up to 7.11.1, and TIBCO Spotfire Desktop Language Packs versions up to 7.11.1.
How severe is CVE-2019-17334?
CVE-2019-17334 has a severity rating of high (8 out of 10).
How can I fix CVE-2019-17334?
Apply the necessary patches or updates provided by TIBCO Software Inc. to fix CVE-2019-17334.
Where can I find more information about CVE-2019-17334?
You can find more information about CVE-2019-17334 on the TIBCO Software Inc. website and the TIBCO Security Advisories page.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/severity
- agent/title
- agent/weakness
- agent/author
- agent/remedy
- agent/first-publish-date
- agent/description
- agent/event
- vendor/tibco
- canonical/tibco spotfire analyst
- version/tibco spotfire analyst/7.11.1
- version/tibco spotfire analyst/7.12.0
- version/tibco spotfire analyst/7.13.0
- version/tibco spotfire analyst/7.14.0
- version/tibco spotfire analyst/10.0.0
- version/tibco spotfire analyst/10.1.0
- version/tibco spotfire analyst/10.2.0
- version/tibco spotfire analyst/10.3.0
- version/tibco spotfire analyst/10.3.1
- version/tibco spotfire analyst/10.3.2
- version/tibco spotfire analyst/10.4.0
- version/tibco spotfire analyst/10.5.0
- version/tibco spotfire analyst/10.6.0
- canonical/tibco spotfire analytics platform for aws
- version/tibco spotfire analytics platform for aws/10.6.0
- canonical/tibco spotfire deployment kit
- version/tibco spotfire deployment kit/7.11.1
- canonical/tibco spotfire desktop
- version/tibco spotfire desktop/7.11.1
- version/tibco spotfire desktop/7.12.0
- version/tibco spotfire desktop/7.13.0
- version/tibco spotfire desktop/7.14.0
- version/tibco spotfire desktop/10.0.0
- version/tibco spotfire desktop/10.1.0
- version/tibco spotfire desktop/10.2.0
- version/tibco spotfire desktop/10.3.0
- version/tibco spotfire desktop/10.3.1
- version/tibco spotfire desktop/10.3.2
- version/tibco spotfire desktop/10.4.0
- version/tibco spotfire desktop/10.5.0
- version/tibco spotfire desktop/10.6.0
- canonical/tibco spotfire desktop language packs
- version/tibco spotfire desktop language packs/7.11.1