Unprotected Windows messaging channel (Shatter) issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary files in the system may be altered. As a result, an arbitrary DLL may be executed with SYSTEM privilege.
Weakness
The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Defense_platform | Hummingheads | * | 3.9.51.0 (including) |