CVE-2018-16156 Privilege escalation in n/a
An attacker can escalate to SYSTEM privileges by placing a malicious DLL in the PATH, exploiting unauthenticated named pipe message processing in PaperStream IP.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-16156?
CVE-2018-16156 is a high-severity vulnerability in n/a, published on 17 May 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over the FjtwMkic_Fjicube_32 named pipe. One of these message processing functions attempts to dynamically load the UninOldIS.dll library and executes an exported function named ChangeUninstallString. The default install does not contain this library and therefore if any DLL with that name exists in any directory listed in the PATH variable, it can be used to escalate to SYSTEM level privilege.
Weakness: CWE-426
Which versions are affected by CVE-2018-16156?
It affects 1 product.
Products include Fujitsu Paperstream Ip \(Twain\).
How do I fix CVE-2018-16156?
No fix has been published for CVE-2018-16156 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-16156 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-16156 exists.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-rp4w-jc8f-mqgx.