CVE-2019-9197: Unity com.unity3d.kharma Protocol Command Injection Remote Code Execution Vulnerability
The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Unity Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handler for the com.unity3d.kharma protocol. A crafted URI with the com.unity3d.kharma protocol can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the current user.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-9197?
CVE-2019-9197 is considered a critical vulnerability as it allows remote attackers to execute arbitrary code.
How do I fix CVE-2019-9197?
To fix CVE-2019-9197, update your Unity Editor to the latest version that addresses this vulnerability.
Who is affected by CVE-2019-9197?
CVE-2019-9197 affects users of specific versions of Unity Editor ranging from 5.6.0 to 2019.2.0a7.
What type of attack vector is involved in CVE-2019-9197?
CVE-2019-9197 can be exploited through a remote code execution vector requiring user interaction.
Is there a workaround for CVE-2019-9197?
Currently, the most effective workaround for CVE-2019-9197 is to avoid using vulnerable versions of the Unity Editor until an update is applied.