CVE-2020-14049: 
NixOS vulnerability analysis and mitigation

Viber for Windows versions up to 13.2.0.39 contained a vulnerability in its custom URI handler (CVE-2020-14049). This vulnerability was discovered as an incomplete fix for a previous issue (CVE-2019-12569). The vulnerability allowed malicious websites to launch Viber with arbitrary parameters, potentially forcing victims to send NTLM authentication requests that could be relayed or captured for password cracking (ZDI Blog).

The vulnerability stemmed from improper parameter quoting in Viber's URI handler. While the previous fix for CVE-2019-12569 prevented loading Qt5 plugins from remote SMB shares, it did not address the underlying issue of Windows performing NTLM authentication when opening SMB shares. When a malicious website triggered the Viber URI handler with specific parameters, Windows would still attempt to authenticate to the remote SMB share, exposing the user's NTLM authentication request (HelpNet Security).

The vulnerability could allow attackers to capture NTLM authentication hashes for offline password cracking or relay the authentication request for potential code execution. This exposed users to potential credential theft and system compromise (ZDI Blog).

The vulnerability could be exploited by convincing a user to visit a malicious website containing a crafted iframe with a specially formatted Viber URI. The attack required no user interaction beyond visiting the malicious page, making it relatively easy to exploit (HelpNet Security).

The issue was remediated by properly quoting the parameters passed by the Viber URI handler. The fix was implemented as: URL:Viber Link C:\Users\jeffssh\AppData\Local\Viber\Viber.exe "%1". Users should update to versions newer than 13.2.0.39 to receive the fix (ZDI Blog).