1

CVE-2014-3802 says that it

allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDB file.

The ZDI page says that:

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

I'm unclear on how this vulnerability is activated. PDB files are used when debugging programs, does this mean that the vulnerability is only present when someone placed a malicious PDB file on the target machine and is debugging the program?

Improve this question

1 Answer 1

Reset to default
1

The vulnerability is present regardless of the existence of a malicious file. The malicious file exploits the vulnerability that exists.

And you have the rest correct. The local user (or a remote user with interactive access to the system (RDP, etc.)) needs to open the malicious file.

Improve this answer
1
  • I understand that the attacker must be able to place a malicious PDB file on the system but in order to activate a PDB (and get the permission of the running process), my understanding is that the user needs to debug the process (so that the PDB is loaded).
    – Motti
    Dec 13, 2022 at 13:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .