PT-2013-1270 · Linter · Linter Bastion

Published 2013-09-10 · Updated 2013-09-10

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Linter Bastion versions (affected versions not specified)

Description The issue arises from an incorrect assumption in the RPC server (linstmgr.exe) that only users with administrator rights can connect to the server. This oversight, combined with the RPC server operating with SYSTEM user privileges, allows for privilege escalation. The fact that most RPC calls do not perform access differentiation within the database management system's access control framework exacerbates this issue. In the case of the linstmgr.exe module, privilege escalation enables an attacker to perform certain actions that they were initially not authorized to do.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-10100

Affected Products

Linter Bastion

References · 1

• https://bdu.fstec.ru/vul/2015-10100 · Security Note