CVE-2019-6739— Malwarebytes Anti-Malware 命令注入漏洞

N/A

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. There is an issue with the way the product handles URIs within certain schemes. The product does not warn the user that a dangerous navigation is about to take place. Because special characters in the URI are not sanitized, this could lead to the execution of arbitrary commands. An attacker can leverage this vulnerability to execute code in the context of the current user at medium integrity. Was ZDI-CAN-7162.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Malwarebytes Anti-Malware 命令注入漏洞

Malwarebytes Anti-Malware是一款基于Windows平台的安全防护软件。该软件能够检测并移除勒索病毒、恶意软件等。 Malwarebytes Anti-Malware 3.6.1.2711版本中存在命令注入漏洞。该漏洞源于外部输入数据构造可执行命令过程中，网络系统或产品未正确过滤其中的特殊元素。攻击者可利用该漏洞执行非法命令。

N/A

N/A