Arbitrary File Creation via Symbolic Link Leading to Denial-of-Service
1. Summary
A vulnerability has been discovered in the TeamViewer Remote Clients for Windows, which can lead to a local denial-of-service condition.
2. Vulnerability Details
CVE-ID | |
Description | Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification.
To exploit this vulnerability, an attacker needs local access to the Windows system.
We have no indication that this vulnerability has been or is being exploited in the wild.
The vulnerability has been fixed with version 15.69 and additional versions listed below. We recommend updating to the latest available version. |
CVSS3.1 Score | Base Score 6.1 (Medium) |
CVSS3.1 Vector String | |
Problem type |
3. Affected products and versions
| Product | Versions | Info |
|---|---|---|
TeamViewer Remote Full Client (Windows) | < 15.69 | |
TeamViewer Remote Host (Windows) | < 15.69 |
4. Solutions and mitigations
Update to the latest version (15.69 or the latest version available)
5. Acknowledgments
Trend Micro Zero Day Initiative