PT-2019-19051 · Check Point · Check Point Zonealarm

Jakub Palaczynski · Publicado 2019-04-17 · Atualizado 2020-10-22 · CVE-2019-8455

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Check Point ZoneAlarm versions up to 15.4.062

Description A local attacker can gain higher privileges to files with limited access by creating a hard-link from the log file of Check Point ZoneAlarm to any file on the system, resulting in permission changes that allow all users to access the linked file.

Recommendations For Check Point ZoneAlarm versions up to 15.4.062, consider restricting access to the log file to prevent attackers from creating hard-links and gaining elevated privileges. As a temporary workaround, monitor file system permissions closely and restrict access to sensitive files until a fix is available.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

CWE-65

Identificadores relacionados

CVE-2019-8455

Produtos afetados

Check Point Zonealarm

Referências · 4

• http://securityfocus.com/bid/108029 · Nota
• https://osv.dev/vulnerability/CVE-2019-8455 · Aviso do Fabricante
• https://zonealarm.com/software/release-history/zafavfw.html#15.4.260.17960 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8455 · Nota de Segurança