CVE-2019-18988

TeamViewer Desktop Bypass Remote Login Vulnerability

Teamviewer

TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions…

7. Feb 2020

Ausgewertete Quellen

• Hersteller
  https://community.teamviewer.com/t5/Announcements/Specification-on-CVE-2019-18988/td-p/82264
• Hersteller
  https://community.teamviewer.com/t5/Knowledge-Base/tkb-p/Knowledgebase?threadtype=label&labels=Security
• Hinweis
  https://twitter.com/Blurbdust/status/1224212682594770946?s=20
• Hinweis
  https://whynotsecurity.com/blog/teamviewer/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18988
• CISA
  TeamViewer Desktop Bypass Remote Login Vulnerability
• NVD
  CVE-2019-18988