PT-2019-12649 · Zoho Manageengine · Patch Manager Plus+17

Hashim Jawad · Published 2019-06-18 · Updated 2020-08-24 · CVE-2019-12133

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.380 Zoho ManageEngine EventLog Analyzer versions 12.0.2 Zoho ManageEngine ServiceDesk Plus versions 10.0.0 Zoho ManageEngine SupportCenter Plus versions 8.1 Zoho ManageEngine O365 Manager Plus versions 4.0 Zoho ManageEngine Mobile Device Manager Plus versions 9.0.0 Zoho ManageEngine Patch Connect Plus versions 9.0.0 Zoho ManageEngine Vulnerability Manager Plus versions 9.0.0 Zoho ManageEngine Patch Manager Plus versions 9.0.0 Zoho ManageEngine OpManager versions 12.3 Zoho ManageEngine NetFlow Analyzer versions 11.0 Zoho ManageEngine OpUtils versions 11.0 Zoho ManageEngine Network Configuration Manager versions 11.0 Zoho ManageEngine FireWall versions 12.0 Zoho ManageEngine Key Manager Plus versions 5.6 Zoho ManageEngine Password Manager Pro versions 9.9 Zoho ManageEngine Analytics Plus versions 1.0 Zoho ManageEngine Browser Security Plus (affected versions not specified)

Description The issue is related to local privilege escalation due to improper permissions for the %SYSTEMDRIVE%ManageEngine directory and its sub-folders. Services associated with the affected products try to execute binaries such as sc.exe from the current directory upon system start, allowing non-privileged users to escalate privileges to NT AUTHORITYSYSTEM.

Recommendations For Desktop Central 10.0.380, update the permissions for the %SYSTEMDRIVE%ManageEngine directory and its sub-folders to prevent non-privileged users from escalating privileges. For EventLog Analyzer 12.0.2, restrict the execution of binaries such as sc.exe from the current directory upon system start. For ServiceDesk Plus 10.0.0, ensure proper permissions are set for the %SYSTEMDRIVE%ManageEngine directory and its sub-folders. For SupportCenter Plus 8.1, consider disabling the execution of binaries from the current directory until a patch is available. For O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Uncontrolled Search Path Element

Incorrect Permission

Weakness Enumeration

CWE-427

CWE-732

Related Identifiers

CVE-2019-12133

Affected Products

Analytics Plus

Browser Security Plus

Desktopcentral

Eventlog Analyzer

Firewall

Key Manager Plus

Mobile Device Manager Plus

Netflow Analyzer

Network Configuration Manager

O365 Manager Plus

Opmanager

Oputils

Password Manager Pro

Patch Connect Plus

Patch Manager Plus

Servicedesk Plus

Supportcenter Plus

Vulnerability Manager Plus

References · 4

• https://manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12133 · Security Note
• https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-007.md · Note