We do not have any indication of active exploitation.ĬVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H Knowledge of the crash event and the TeamViewer ID as well as either possession of the pre-crash connection password or local authenticated access to the machine would have allowed to establish a remote connection by reusing the not properly deleted connection password. TeamViewer Linux versions before 15.28 did not properly execute a deletion command for the connection password in case of a process crash. We recommend updating your Linux client installations at the earliest convenience. The bug has been fixed with version 15.28. We thank Weaponshotgun & WildZarek very much for their research and responsible disclosure.A bug has been found in TeamViewer for Linux before 15.28, that could result in an inadvertent re-use of a previously used connection password after a process crash.
Additional Resourcesįor users leveraging passwordless authentication (“Easy Access”) and/or MFA for connections the issue is not exploitable. Update to the latest version (15.28 or higher) 5. A bug has been found in TeamViewer for Linux before 15.28, that could result in an inadvertent re-use of a previously used connection password after a process crash.
0 kommentar(er)
