CVE-2014-4936

The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

16.78% chance of exploitation in the next 30 days, 97th percentile

Published

2014-12-16

Updated

2024-08-06

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/130244/Malwarebytes-Anti-Malware-Anti-Exploit-Update…
• 0x3a/CVE-2014-49367★ · 2014-12-11

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/malwarebytes_upd…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/41701

References

• CVE Record
• NVD entry

Related

• CVE-2014-4927
• CVE-2014-4937
• CVE-2014-4912
• CVE-2014-4938
• CVE-2014-4880
• CVE-2014-4939