CVE-2011-5158 — HIGH (9.3) — White Hats Nepal

Vulnerability Description

Multiple untrusted search path vulnerabilities in the DMTGUI2.EXE and DvInesLogFileViewer.Exe components in DATEV Grundpaket Basis CD23.20 allow local users to gain privileges via a Trojan horse (1) DVBSKNLANG101.dll or (2) DvZediTermSrvInfo004.dll file in the current working directory, as demonstrated by a directory that contains a .dmt, .adl, .c02, .dof, or .jrf file. NOTE: some of these details are obtained from third party information.

CVSS Score

9.3

HIGH

AV:N/AC:M/Au:N/C:C/I:C/A:C

Confidentiality

COMPLETE

Integrity

COMPLETE

Availability

COMPLETE

Affected Products

Vendor	Product	Versions
Datev	Grundpaket Basis	cd23.20

Related Weaknesses (CWE)

CWE-426

References

http://secunia.com/advisories/42940Third Party Advisory
http://sotiriu.de/adv/NSOADV-2010-010.txtExploitThird Party Advisory
http://secunia.com/advisories/42940Third Party Advisory
http://sotiriu.de/adv/NSOADV-2010-010.txtExploitThird Party Advisory

FAQ

What is CVE-2011-5158?

CVE-2011-5158 is a vulnerability with a CVSS score of 9.3 (HIGH). Multiple untrusted search path vulnerabilities in the DMTGUI2.EXE and DvInesLogFileViewer.Exe components in DATEV Grundpaket Basis CD23.20 allow local users to gain privileges via a Trojan horse (1) D...

How severe is CVE-2011-5158?

CVE-2011-5158 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2011-5158?

Check the references section above for vendor advisories and patch information. Affected products include: Datev Grundpaket Basis.