CVE-2014-4936 The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute a...
HighCVSS 9.3
EPSS 16.8%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| malwarebytes anti-exploit | <= 1.04.1.1012 | No fix listed |
| malwarebytes anti-malware | <= 2.02 | No fix listed |
References
- blog.0x3a.com exploit
- packetstormsecurity.com