QID 375513

QID 375513: Dameware Mini remote control Unauthenticated Remote Buffer Over-Read Vulnerability

Solarwinds Dameware Remote Mini Controller is a software for assisting in remote desktop connections for helpdesk support.

CVE-2019-3955: Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the server not properly validating RsaPubKeyLen during key negotiation.

CVE-2019-3956: Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating CltDHPubKeyLen during key negotiation.

CVE-2019-3957: Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating RsaSignatureLen during key negotiation.
Affected Version:
SolarWinds Dameware 12.1.0.34 and prior.

QID Detection Logic(Authenticated)
QID will to find the affected version of SolarWinds Dameware through registry key from installed location.

An unauthenticated remote attacker can cause a heap buffer overflow by specifying a large RsaPubKeyLen, which could cause a denial of service.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 5.8 severity.

Solution

Solarwinds has released version 12.1.0.89 or in Hotfix 2 to address this issue.

Please refer DameWare

Vendor References

Dameware - support.solarwinds.com/SuccessCenter/s/article/Dameware-Mini-Remote-Control-12-1-0-Hotfix-2-Release-Notes?language=en_US

CVEs related to QID 375513

CVE-2019-3955 | CVE-2019-3956 | CVE-2019-3957 |

Software Advisories

Advisory ID	Software	Component	Link
Dameware			www.dameware.com/products/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].