CVE-2019-11644

Published May 17, 2019

Last updated 4 years ago

Overview

Description: In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10, F-Secure PSB Workstation Security before 12.01, and F-Secure Computer Protection Standard and Premium before 19.3, a local user can escalate their privileges through a DLL hijacking attack against the installer. The installer writes the file rm.exe to C:\Windows\Temp and then executes it. The rm.exe process then attempts to load several DLLs from its current directory. Non-admin users are able to write to this folder, so an attacker can create a malicious C:\Windows\Temp\OLEACC.dll file. When an admin runs the installer, rm.exe will execute the attacker's DLL in an elevated security context.
Source: cve@mitre.org
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.0

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-427

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:f-secure:client_security:*:*:*:*:premium:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D3A01148-E184-4D94-B0EA-FA6AC02DA027",
            "versionEndExcluding": "14.10"
          },
          {
            "criteria": "cpe:2.3:a:f-secure:client_security:*:*:*:*:standard:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4B3C0CA2-98CC-463F-BF04-77CB070AAC81",
            "versionEndExcluding": "14.10"
          },
          {
            "criteria": "cpe:2.3:a:f-secure:computer_protection:*:*:*:*:premium:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CB3FBAD7-5965-48E3-994B-97036BB7B0EA",
            "versionEndExcluding": "19.3"
          },
          {
            "criteria": "cpe:2.3:a:f-secure:computer_protection:*:*:*:*:standard:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3B2B925E-6F9C-48D7-9EE4-0D7B47DF2AC5",
            "versionEndExcluding": "19.3"
          },
          {
            "criteria": "cpe:2.3:a:f-secure:internet_security:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AC544B1A-E94E-48A2-835E-4CBAF62B5EED",
            "versionEndExcluding": "17.6"
          },
          {
            "criteria": "cpe:2.3:a:f-secure:psb_workstation_security:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6B8BDF27-DCEB-4CD0-9BA8-521FDC12FB02",
            "versionEndExcluding": "12.01"
          },
          {
            "criteria": "cpe:2.3:a:f-secure:safe:*:*:*:*:*:windows:*:*",
            "vulnerable": true,
            "matchCriteriaId": "63FEAA9D-3E79-4F39-9EEF-1B41AF6FFE66",
            "versionEndExcluding": "17.6"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.0

CVSS 2.0

Weaknesses

Configurations

References