A Dangerous Vulnerability Has Been Discovered in TeamViewer

Windows remote desktop connection software TeamViewer It is quite popular among users. If you are one of the users of this popular software, check whether you are using the latest version of the program.

The developer team recently released a new version for TeamViewer. In this version, there are some security features that, if detonated, may cause attackers to steal your system password and endanger your system. serious security vulnerabilities There are patches where it is disabled.

Vulnerability in TeamViewer

What's really worrying about this vulnerability is that it simply convinces the victim to visit a malicious website once, without requiring much interaction from the victim. It can be applied almost automatically.

To put the vulnerability simply: an attacker uses a website to TeamViewer's URI scheme to trick the installed application on the victim's system and initiate a connection to the remote SMB share owned by the attacker. In this way, the SMB authentication attack is triggered. The username and NTLMv2 hashed password version in the system is leaked to the attacker. The attacker can use the stolen credentials to authenticate the victim's computer and network resources.

In order to exploit this security vulnerability, you need to visit a website. must embed a malicious 'iframe' and trick the victim into clicking on that address. If the victim clicks on this URL, TeamViwer automatically launches the Windows desktop client and turns on remote SMB sharing.

who discovered this vulnerability Jeffrey Hoffman, said that this vulnerability is categorized as 'Unquoted URI handler' and affects URI handlers teamviewer10, teamviewer8, teamviewerapi, tvchat1, tvcontrol1, tvfiletransfer1, tvjoinv8, tvpresent1, tvsendfile1, tvsqcustomer1, tvsqsupport1, tvvideocall1 and tvvpn1.

As we said above, the developer team patched TeamViewer. In addition, this vulnerability has not been exploited on a large scale so far, but considering the popularity of the program, there is always the possibility of being targeted. Therefore the program latest version It is important that you use it.