critical9.3Public exploit code
CVE-2014-4936
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Malwarebytes Anti-Malware < 2.0.3 / Anti-Exploit < 1.03.1.1220 - Update Code Execution (Metasploit)2014-12-16 · local · windows · Verified
Impact
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Malwarebytes | Malwarebytes Anti-Exploit | through 1.04.1.1012 |
| Malwarebytes | Malwarebytes Anti-Malware | through 2.02 |
Weakness classification
References
- NVD record
- CVE.org record
- http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and
- http://packetstormsecurity.com/files/130244/Malwarebytes-Anti-Malware-Anti-Exploit-Update-Remote-Code-Execution.html
- http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and
- http://packetstormsecurity.com/files/130244/Malwarebytes-Anti-Malware-Anti-Exploit-Update-Remote-Code-Execution.html