CVE-2019-9565
Critical
Description
Druide Antidote RX, HD, 8 before 8.05.2287, 9 before 9.5.3937 and 10 before 10.1.2147 allows remote attackers to steal NTLM hashes or perform SMB relay attacks upon a direct launch of the product, or upon an indirect launch via an integration such as Chrome, Firefox, Word, Outlook, etc. This occurs because the product attempts to access a share with the PLUG-INS subdomain name; an attacker may be able to use Active Directory Domain Services to register that name.
SeverityCritical
CVSS9.1
Exploit probability—
ProductDruide Antidote
PublishedMar 4, 2019
First seenMar 4, 2019
How to fix
Update
- druide antidote8.05.2287, 9.5.3937, 10.1.2147 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| druide antidote | 8.0 ≤ v < 8.05.2287, 9.0 ≤ v < 9.5.3937, 10.0 ≤ v < 10.1.2147 | 8.05.2287, 9.5.3937, 10.1.2147 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.