github - ghsa-xm85-53qc-rpxj

GHSA-XM85-53QC-RPXJ

Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-24 17:43

Details

A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk (KRD) and was trusted by the Authentication Agent of Full Disk Encryption in Kaspersky Endpoint Security (KES). This issue allowed to bypass the UEFI Secure Boot security feature. An attacker would need physical access to the computer to exploit it. Otherwise, local administrator privileges would be required to modify the boot loader component.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-26200"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-02-26T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk (KRD) and was trusted by the Authentication Agent of Full Disk Encryption in Kaspersky Endpoint Security (KES). This issue allowed to bypass the UEFI Secure Boot security feature. An attacker would need physical access to the computer to exploit it. Otherwise, local administrator privileges would be required to modify the boot loader component.",
  "id": "GHSA-xm85-53qc-rpxj",
  "modified": "2022-05-24T17:43:08Z",
  "published": "2022-05-24T17:43:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26200"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CVEProject/cvelist/blob/master/2020/26xxx/CVE-2020-26200.json"
    },
    {
      "type": "WEB",
      "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#170221"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2020-26200 (GCVE-0-2020-26200)

Vulnerability from cvelistv5 – Published: 2021-02-26 13:30 – Updated: 2024-08-04 15:49

Summary

Severity ?

No CVSS data available.

CWE

Bypass

Assigner

Kaspersky

References

URL

Tags

https://support.kaspersky.com/general/vulnerabili…

x_refsource_MISC

Impacted products

Vendor

Product

Version

N/A

Kaspersky Rescue Disk Version

Affected: All versions prior to 18.0.11.3 (patch C)

N/A

Kaspersky Endpoint Security with the Full Disk Encryption component installed

Affected: 10 SP2 MR2
Affected: 10 SP2 MR3
Affected: 11.0.0
Affected: 11.0.1
Affected: 11.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:49:07.172Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#170221"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kaspersky Rescue Disk Version",
          "vendor": "N/A",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 18.0.11.3 (patch C)"
            }
          ]
        },
        {
          "product": "Kaspersky Endpoint Security with the Full Disk Encryption component installed",
          "vendor": "N/A",
          "versions": [
            {
              "status": "affected",
              "version": "10 SP2 MR2"
            },
            {
              "status": "affected",
              "version": "10 SP2 MR3"
            },
            {
              "status": "affected",
              "version": "11.0.0"
            },
            {
              "status": "affected",
              "version": "11.0.1"
            },
            {
              "status": "affected",
              "version": "11.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk (KRD) and was trusted by the Authentication Agent of Full Disk Encryption in Kaspersky Endpoint Security (KES). This issue allowed to bypass the UEFI Secure Boot security feature. An attacker would need physical access to the computer to exploit it. Otherwise, local administrator privileges would be required to modify the boot loader component."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-26T13:30:23",
        "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
        "shortName": "Kaspersky"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#170221"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnerability@kaspersky.com",
          "ID": "CVE-2020-26200",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Kaspersky Rescue Disk Version",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior to 18.0.11.3 (patch C)"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Kaspersky Endpoint Security with the Full Disk Encryption component installed",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "10 SP2 MR2"
                          },
                          {
                            "version_value": "10 SP2 MR3"
                          },
                          {
                            "version_value": "11.0.0"
                          },
                          {
                            "version_value": "11.0.1"
                          },
                          {
                            "version_value": "11.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "N/A"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk (KRD) and was trusted by the Authentication Agent of Full Disk Encryption in Kaspersky Endpoint Security (KES). This issue allowed to bypass the UEFI Secure Boot security feature. An attacker would need physical access to the computer to exploit it. Otherwise, local administrator privileges would be required to modify the boot loader component."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#170221",
              "refsource": "MISC",
              "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#170221"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
    "assignerShortName": "Kaspersky",
    "cveId": "CVE-2020-26200",
    "datePublished": "2021-02-26T13:30:23",
    "dateReserved": "2020-09-30T00:00:00",
    "dateUpdated": "2024-08-04T15:49:07.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-XM85-53QC-RPXJ

CVE-2020-26200 (GCVE-0-2020-26200)

Tags

Sightings

Nomenclature