PT-2019-4233 · Dropbox · Dropbox

Publicado 2019-12-18 · Atualizado 2019-12-18

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dropbox client for Windows (affected versions not specified)

Description The issue is related to insufficient access control in the Dropbox update service, dropboxupdate. It can be exploited by creating a specially crafted hard link, potentially allowing an attacker to elevate their privileges to the root level.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-65

Identificadores relacionados

BDU:2019-04834

Produtos afetados

Dropbox

Referências · 4

• https://github.com/google/omaha/blob/4ff781228c319177e9b5d6195464eccf226f4a3c/omaha/base/logging.cc#L1000 · Nota
• https://decoder.cloud/2019/12/18/from-dropboxupdater-to-nt-authoritysystem · Nota
• https://xakep.ru/2019/12/25/dropbox-eop · Nota
• https://bdu.fstec.ru/vul/2019-04834 · Nota de Segurança