Palo Alto Networks Security Advisories / CVE-2020-1986

CVE-2020-1986 Secdo: Local authenticated users can cause Windows system crash

047910
Severity 5.5 · MEDIUM
Attack Vector LOCAL
Attack Complexity LOW
Privileges Required LOW
User Interaction NONE
Scope UNCHANGED
Confidentiality Impact NONE
Integrity Impact NONE
Availability Impact HIGH

Description

Improper input validation vulnerability in Secdo allows an authenticated local user with 'create folders or append data' access to the root of the OS disk (C:\) to cause a system crash on every login. This issue affects all versions Secdo for Windows.

Product Status

VersionsAffectedUnaffected
Secdo all versions on Windows

Severity: MEDIUM

CVSSv3.1 Base Score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness Type

CWE-20 Improper Input Validation

Solution

This product is no longer supported and the issue will not be fixed. This issue can be easily mitigated by creating a "C:\proc" folder and not allowing unprivileged users to access to that folder, or ensuring unprivileged users do not have 'create folder' access to the root of a disk (C:\).

Workarounds and Mitigations

Exploitation of this issue can be prevented by creating a "C:\proc" folder and not allowing unprivileged users to access that folder.

Acknowledgments

We like to thank Eviatar Gerzi of CyberArk Labs Team for discovering and reporting this issue.

Timeline

Initial publication
© 2020 Palo Alto Networks, Inc. All rights reserved.