PT-2019-15888 · Secureworks · Secureworks Red Cloak Windows Agent

Publicado 2019-12-06 · Atualizado 2019-12-17 · CVE-2019-19620

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SecureWorks Red Cloak Windows Agent versions prior to 2.0.7.9

Description A local user can bypass the generation of telemetry alerts by removing NT AUTHORITYSYSTEM permissions from a file, which is limited in scope to the collection of process-execution telemetry for executions against specific files where the SYSTEM user was denied access to the source file.

Recommendations For SecureWorks Red Cloak Windows Agent versions prior to 2.0.7.9, update to version 2.0.7.9 or later to resolve the issue.

Exploit

Correção

Improper Preservation of Permissions

Enumeração de Fraquezas

CWE-281

Identificadores relacionados

CVE-2019-19620

Produtos afetados

Secureworks Red Cloak Windows Agent

Referências · 5

• 🔥 https://medium.com/@CowbellSteve/secureworks-red-cloak-local-bypass-bfaed2be407e · Exploit
• https://secureworks.com/resources/ds-aetd-red-cloak-data-sheet · Aviso do Fabricante
• https://medium.com/%40CowbellSteve/secureworks-red-cloak-local-bypass-bfaed2be407e · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-19620 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-19620 · Aviso do Fabricante