github - ghsa-5prc-43fj-m4f2

GHSA-5PRC-43FJ-M4F2

Vulnerability from github – Published: 2022-05-24 16:44 – Updated: 2022-05-24 16:44

Details

A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-8452"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-22T22:29:00Z",
    "severity": "HIGH"
  },
  "details": "A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file.",
  "id": "GHSA-5prc-43fj-m4f2",
  "modified": "2022-05-24T16:44:30Z",
  "published": "2022-05-24T16:44:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8452"
    },
    {
      "type": "WEB",
      "url": "https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=\u0026solutionid=sk150012"
    },
    {
      "type": "WEB",
      "url": "https://www.zonealarm.com/software/release-history/zafavfw.html#15.4.260.17960"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/154754/CheckPoint-Endpoint-Security-Client-ZoneAlarm-Privilege-Escalation.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2019-8452 (GCVE-0-2019-8452)

Vulnerability from cvelistv5 – Published: 2019-04-22 21:43 – Updated: 2024-08-04 21:17

Summary

Severity ?

No CVSS data available.

CWE

CWE-65

Assigner

checkpoint

References

URL

Tags

	https://www.zonealarm.com/software/release-histor…	x_refsource_MISC
	https://supportcenter.us.checkpoint.com/supportce…	x_refsource_CONFIRM
	http://packetstormsecurity.com/files/154754/Check…	x_refsource_MISC

Impacted products

Vendor

Product

Version

Check Point ZoneAlarm

Affected: Check Point ZoneAlarm up to 15.4.062

Check Point ZoneAlarm

Check Point Endpoint Security client for Windows

Affected: Check Point Endpoint Security client for Windows before E80.96

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T21:17:31.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zonealarm.com/software/release-history/zafavfw.html#15.4.260.17960"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=\u0026solutionid=sk150012"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/154754/CheckPoint-Endpoint-Security-Client-ZoneAlarm-Privilege-Escalation.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Check Point ZoneAlarm",
          "vendor": "Check Point ZoneAlarm",
          "versions": [
            {
              "status": "affected",
              "version": "Check Point ZoneAlarm up to 15.4.062"
            }
          ]
        },
        {
          "product": "Check Point Endpoint Security client for Windows",
          "vendor": "Check Point ZoneAlarm",
          "versions": [
            {
              "status": "affected",
              "version": "Check Point Endpoint Security client for Windows before E80.96"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-65",
              "description": "CWE-65",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-07T16:06:05",
        "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
        "shortName": "checkpoint"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zonealarm.com/software/release-history/zafavfw.html#15.4.260.17960"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=\u0026solutionid=sk150012"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/154754/CheckPoint-Endpoint-Security-Client-ZoneAlarm-Privilege-Escalation.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@checkpoint.com",
          "ID": "CVE-2019-8452",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Check Point ZoneAlarm",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Check Point ZoneAlarm up to 15.4.062"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Check Point Endpoint Security client for Windows",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Check Point Endpoint Security client for Windows before E80.96"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Check Point ZoneAlarm"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-65"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zonealarm.com/software/release-history/zafavfw.html#15.4.260.17960",
              "refsource": "MISC",
              "url": "https://www.zonealarm.com/software/release-history/zafavfw.html#15.4.260.17960"
            },
            {
              "name": "https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=\u0026solutionid=sk150012",
              "refsource": "CONFIRM",
              "url": "https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=\u0026solutionid=sk150012"
            },
            {
              "name": "http://packetstormsecurity.com/files/154754/CheckPoint-Endpoint-Security-Client-ZoneAlarm-Privilege-Escalation.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/154754/CheckPoint-Endpoint-Security-Client-ZoneAlarm-Privilege-Escalation.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
    "assignerShortName": "checkpoint",
    "cveId": "CVE-2019-8452",
    "datePublished": "2019-04-22T21:43:19",
    "dateReserved": "2019-02-18T00:00:00",
    "dateUpdated": "2024-08-04T21:17:31.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-5PRC-43FJ-M4F2

CVE-2019-8452 (GCVE-0-2019-8452)

Tags

Sightings

Nomenclature