Aspera Desktop App
Monthly
Arbitrary code execution in the IBM Aspera Desktop App (versions 1.0.5 through 1.0.19) arises from insecure DLL loading at application start-up, allowing a local low-privileged attacker who can place a malicious DLL in a path the app searches to run code in the context of the launching user. IBM (the reporter and vendor) has published a fix, and there is no public exploit identified at time of analysis. Impact is high to confidentiality, integrity, and availability, but exploitation is gated by local access and the user launching the application.
Path traversal vulnerability in IBM Aspera Desktop App 1.0.5–1.0.19 allows remote attackers to write files outside the user’s intended download directory by enticing a user to interact with a malicious download request or file. No active exploitation or public exploit code has been identified at the time of analysis, and a vendor patch is available.
Arbitrary code execution in the IBM Aspera Desktop App (versions 1.0.5 through 1.0.19) arises from insecure DLL loading at application start-up, allowing a local low-privileged attacker who can place a malicious DLL in a path the app searches to run code in the context of the launching user. IBM (the reporter and vendor) has published a fix, and there is no public exploit identified at time of analysis. Impact is high to confidentiality, integrity, and availability, but exploitation is gated by local access and the user launching the application.
Path traversal vulnerability in IBM Aspera Desktop App 1.0.5–1.0.19 allows remote attackers to write files outside the user’s intended download directory by enticing a user to interact with a malicious download request or file. No active exploitation or public exploit code has been identified at the time of analysis, and a vendor patch is available.