PT-2019-13091 · Artica+1 · Artica Pandora Fms+1

Hashim Jawad · Published 2019-06-29 · Updated 2020-08-24 · CVE-2019-13035

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Artica Pandora FMS versions 7.0 NG before 735

Description The issue is related to improper permissions on the C:PandoraFMS directory and its sub-folders, allowing standard users to create new files. When the Apache service httpd.exe receives web requests to the portal, it attempts to execute cmd.exe from the C:PandoraFMS directory as NT AUTHORITYSYSTEM. This allows non-privileged users to escalate privileges to NT AUTHORITYSYSTEM.

Recommendations For Artica Pandora FMS version 7.0 NG before 735, update to version 735 or later to resolve the issue. As a temporary workaround, consider restricting write access to the C:PandoraFMS directory and its sub-folders to prevent standard users from creating new files. Additionally, restrict the execution of cmd.exe by the Apache service httpd.exe to minimize the risk of privilege escalation.

Fix

Related Identifiers

CVE-2019-13035

Affected Products

Apache Http Server

Artica Pandora Fms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-13035 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13035 · Vendor Advisory
• https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-008.md · Note
• https://t.me/malwr/1498 · Telegram Post