PT-2017-17971 · Apc · Apc Ups Daemon

Fragsh3Ll + 1 · Published 2017-06-16 · Updated 2019-10-03 · CVE-2017-7884

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions APC UPS Daemon versions through 3.14.14

Description The default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges. This is possible by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM privileges at startup, due to "RW NT AUTHORITYAuthenticated Users" permissions for %SYSTEMDRIVE%apcupsdbinapcupsd.exe.

Recommendations For APC UPS Daemon versions through 3.14.14, consider restricting write access to the %SYSTEMDRIVE%apcupsdbinapcupsd.exe file to prevent replacement with a malicious executable. As a temporary workaround, monitor the integrity of the apcupsd.exe file to detect any unauthorized changes.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2017-7884

Affected Products

Apc Ups Daemon

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-7884 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7884 · Vendor Advisory
• http://securityfocus.com/bid/99092 · Note
• http://securitytracker.com/id/1038707 · Note
• http://seclists.org/fulldisclosure/2017/Jun/20 · Note