An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges.
References
Link | Resource |
---|---|
https://www.manageengine.com/products/desktop-central/ | Product Vendor Advisory |
https://www.manageengine.com/products/desktop-central/integer-overflow-vulnerability.html | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-10-02T19:06:42
Updated: 2020-10-02T19:06:42
Reserved: 2020-08-19T00:00:00
Link: CVE-2020-24397
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-10-02T20:15:12.970
Modified: 2021-07-21T11:39:23.747
Link: CVE-2020-24397
JSON object: View
Redhat Information
No data.