Teamviewer Vulnerability Lets attacker Steal System Password

4 46
Avatar for Secure
Written by
4 years ago

The popular remote access tool Teamviewer recently patched a vulnerability init clients that cloud leak your password to an attacker. An attacker can prepare a malicious website that will use the specific TeamViewer URI to launch the application when visited.

 The tricky part is that due to some issues with quoting strings the attacker can add a new play argument to the site linking to a remote unc path under their control.  

And now any vulnerable client will then try to connect to the remote SMB share on the unc path and send the users NTLM authentication request which basically is a simple password hash.

The attacker can then either relay the NTLM request to a target machine or simply brute force the user's password in order to get full access and of course from there on its game over.

The vulnerability has been patched in version 15.8.3 and is highly recommended to update your version. If you don't want to keep track manually then, of course, you can use the vulnerability assessment and patch management built into Acronis cyber protect which can automatically update Teamviewer and keep you safe.

7
$ 0.00
Sponsors of Secure
empty
empty
empty

Comments

thats why i dont use teamviewer at all there is other application out there better than teamviewer

$ 0.00
4 years ago

yeah @serans but now the bug is now patched in the latest version 15.8.3

$ 0.00
4 years ago

Thank you for this update @Secure. The ball is now in the court of users big team viewer to update to the version that is free of this vulnerability to avoid stories that touch.

$ 0.00
User's avatar M3i
4 years ago

Good night 😍😍😍dear

$ 0.00
4 years ago