CVEvulnerability
CVE-2014-4936
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-12-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-345
Description
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.
Affected configurations
• malwarebytes malwarebytes anti-exploit (<= 1.04.1.1012)
• malwarebytes malwarebytes anti-malware (<= 2.02)
Related
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and Exploit
- http://packetstormsecurity.com/files/130244/Malwarebytes-Anti-Malware-Anti-Exploit-Update-Remote-Code-Execution.html packetstormsecurity.com
- http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and Exploit
- http://packetstormsecurity.com/files/130244/Malwarebytes-Anti-Malware-Anti-Exploit-Update-Remote-Code-Execution.html packetstormsecurity.com