PT-2014-8833 · Wolters Kluwer · Cch Wolters Kluwer Prosystem Fx Engagement

Singularitysec · Published 2014-12-02 · Updated 2014-12-15 · CVE-2014-9113

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) versions 7.1 and earlier

Description The issue concerns weak permissions for certain service files, specifically Pfx.Engagement.WcfServices, PFXEngDesktopService, PFXSYNPFTService, and P2EWinService, which are set to allow Authenticated Users to modify and write. This weakness can be exploited by local users to gain LocalSystem privileges through the use of a Trojan horse file.

Recommendations For versions 7.1 and earlier, consider restricting the permissions of the service files Pfx.Engagement.WcfServices, PFXEngDesktopService, PFXSYNPFTService, and P2EWinService to prevent unauthorized modifications. As a temporary workaround, monitor these files closely for any suspicious activity until a more permanent solution is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-9113

Affected Products

Cch Wolters Kluwer Prosystem Fx Engagement

References · 5

• 🔥 https://exploit-db.com/exploits/35395 · Exploit
• 🔥 http://exploit-db.com/exploits/35395 · Exploit
• 🔥 http://information-paradox.net/2014/11/cve-2014-9113-cch-wolters-kluwer-pfx.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9113 · Security Note
• http://packetstormsecurity.com/files/129323/CCH-Wolters-Kluwer-PFX-Engagement-7.1-Privilege-Escalation.html · Note