JVN#13555032: Multiple vulnerabilities in VAIO Update

VAIO Update provided by Sony Corporation contains multiple vulnerabilities listed below.

Improper authorization process (CWE-285) - CVE-2019-5981

Improper verification of download file (CWE-669) - CVE-2019-5982

This analysis assumes a man-in-the-middle attack being conducted by an attacker that places a malicious wireless LAN access point.

Impact

• An attacker may execute arbitrarily executable files with administrative privilege. - CVE-2019-5981
• A successful man-in-the-middle attack may result in a specially crafted file prepared by an attacker being downloaded and executed. - CVE-2019-5982

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• VAIO Update 7.3.0.03150 and earlier