https://success.vipre.com/en_US/home-windows-release-notes/home-windows-release-notes-20240227 <br/></td> CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"/>https://success.vipre.com/en_US/home-windows-release-notes/home-windows-release-notes-20240227 <br/></td> CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"/>

Exploit
CVE-2024-5928

Improper Link Resolution Before File Access ('Link Following') (CWE-59)

Published: Jun 20, 2024 / Updated: 4mo ago

010
CVSS 7.8EPSS 0.05%High
CVE info copied to clipboard

Summary

This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. The specific flaw exists within the Patch Management Agent. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Impact

An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. This could potentially lead to complete system compromise, allowing the attacker to gain full control over the affected machine, access sensitive data, install malware, or perform any action with SYSTEM-level privileges.

Exploitation

One proof-of-concept exploit is available on zerodayinitiative.com. There is no evidence of proof of exploitation at the moment.

Patch

VIPRE has issued an update to correct this vulnerability. The patch is available, and more details can be found at: https://success.vipre.com/en_US/home-windows-release-notes/home-windows-release-notes-20240227

Mitigation

1. Apply the patch provided by VIPRE as soon as possible. 2. Limit user privileges and ensure principle of least privilege is followed. 3. Monitor for suspicious activities, especially those related to symbolic link creation and file deletion. 4. Implement strong access controls to prevent unauthorized local access. 5. Keep VIPRE Advanced Security and all other software up to date.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-5928. See article

Jun 21, 2024 at 4:32 AM / VulDB Recent Entries
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Jun 21, 2024 at 4:33 AM
CVSS

A CVSS base score of 7.8 has been assigned.

Jul 1, 2024 at 10:46 PM / zdi-advisories
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Aug 21, 2024 at 5:21 PM
Static CVE Timeline Graph

Affected Systems

Vipre/advanced_security
+null more

Exploits

https://www.zerodayinitiative.com/advisories/ZDI-24-817/
+null more

Links to Mitre Att&cks

T1547.009: Shortcut Modification
+null more

Attack Patterns

CAPEC-132: Symlink Attack
+null more

Vendor Advisory

ZDI-24-817: VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-5928.

News

Security bulletin - 28 Aug 2024 - Cyber Security Agency of Singapore
Security bulletin - 28 Aug 2024 Cyber Security Agency of Singapore
CVE-2024-5928
VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Patch Management Agent. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was...
CVE-2024-5928 - VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability
CVE ID : CVE-2024-5928 Published : Aug. 21, 2024, 5:15 p.m. 16 minutes ago Description : VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Patch Management Agent.
CVE-2024-5928
VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Patch Management Agent. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22315.
CVE-2024-5928 | VIPRE Advanced Security PMAgent link following
A vulnerability classified as critical has been found in VIPRE Advanced Security . This affects an unknown part of the component PMAgent . The manipulation leads to link following. This vulnerability is uniquely identified as CVE-2024-5928 . Local access is required to approach this attack. There is no exploit available. It is recommended to upgrade the affected component.
See 1 more articles and social media posts

CVSS V3.1

Attack Vector:Local
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI