Lucene search

MitreCVE-2013-2604

HistoryJan 12, 2015 - 7:59 p.m.

CVE-2013-2604

2015-01-1219:59:01

CWE-264

mitre

web.nvd.nist.gov

realnetworks

gamehouse

realarcade

installer

weak permissions

vulnerability

local users

privileges

trojan horse

dll

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

46.9%

JSON

RealNetworks GameHouse RealArcade Installer (aka ActiveMARK Game Installer) 2.6.0.481 and 3.0.7 uses weak permissions (Create Files/Write Data) for the GameHouse Games directory tree, which allows local users to gain privileges via a Trojan horse DLL in an individual game’s directory, as demonstrated by DDRAW.DLL in the Zuma Deluxe directory.

Affected configurations

Nvd

Node

realnetworksrealarcade_installerMatch2.6.0.481

realnetworksrealarcade_installerMatch3.0.7

VendorProductVersionCPE
realnetworksrealarcade_installer2.6.0.481cpe:2.3:a:realnetworks:realarcade_installer:2.6.0.481:*:*:*:*:*:*:*
realnetworksrealarcade_installer3.0.7cpe:2.3:a:realnetworks:realarcade_installer:3.0.7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
realnetworks	realarcade_installer	2.6.0.481	cpe:2.3:a:realnetworks:realarcade_installer:2.6.0.481:::::::*
realnetworks	realarcade_installer	3.0.7	cpe:2.3:a:realnetworks:realarcade_installer:3.0.7:::::::*

References

www.osvdb.org/96918

www.riskbasedsecurity.com/reports/RBS-GameHouseAnalysis-Sept2013.pdf

www.riskbasedsecurity.com/research/RBS-2013-005.pdf

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

46.9%

JSON

Related for CVE-2013-2604