---
title: Security Bulletin NR18-10
source: https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-10
---

## Summary

A security update for the Windows Infrastructure agent corrects an issue where a hard-coded file path may allow a malicious user to override the agent configuration.

**Release date:** June 18, 2018

**Vulnerability identifier:** NR18-10

**Priority:** High

## Affected software [#affected]

The following New Relic agent versions are affected:

| Name                         | Affected version        | Notes | Remediated version |
| ---------------------------- | ----------------------- | ----- | ------------------ |
| Windows Infrastructure agent | From 1.0.682 to 1.0.912 |       | 1.0.934            |

## Vulnerability information [#vuln-info]

The New Relic Windows Infrastructure agent looks in specific locations for configuration files. A Unix-only file path was included in the Windows agent which could allow a malicious user to override the configuration file. With this security update, the Windows Infrastructure agent will no longer look in a Unix-specific location.

### Mitigating factors [#factors]

-   This vulnerability only exists on Windows systems.
-   This vulnerability requires existing access to the system.

## Workarounds

N/A

## Report security vulnerabilities to New Relic [#report]

New Relic is committed to the security of our customers and their data. If you believe you have found a security vulnerability in one of our products or websites, we welcome and greatly appreciate you reporting it to New Relic's coordinated disclosure program. For more information, see [Reporting security vulnerabilities](https://docs.newrelic.com/docs/security/new-relic-security/data-privacy/reporting-security-vulnerabilities).

## For more help [#more_help]

Additional documentation resources include:.

-   [Upgrade the .NET agent](https://docs.newrelic.com/docs/agents/net-agent/installation/update-net-agent)
-   [Upgrade the Java agent](https://docs.newrelic.com/docs/agents/java-agent/installation/upgrade-java-agent)
-   [Upgrade the Python agent](https://docs.newrelic.com/docs/agents/python-agent/installation-configuration/upgrade-python-agent)
-   [NR Security](https://newrelic.com/security)