CVE-2023-45284
MediumSummary
The IsLocal function on Windows incorrectly detects reserved device names in some cases. Reserved names followed by spaces (e.g., "COM1 ") and names "COM" and "LPT" with superscript 1, 2, or 3 are incorrectly reported as local. The fix ensures IsLocal now correctly identifies these.
Risk Assessment
The risk is that applications may mistakenly treat remote resources as local, potentially leading to unauthorized access to files or devices. This could allow an attacker to bypass access controls and escalate privileges.
Recommendation
It is recommended to immediately update to a version containing the fix for CVE-2023-45284. Also review configurations of applications using the IsLocal function to ensure they do not rely on the incorrect behavior.
Original NVD description (English source)
On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these