PT-2019-4233 · Dropbox · Dropbox

Published 2019-12-18 · Updated 2019-12-18

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dropbox client for Windows (affected versions not specified)

Description The issue is related to insufficient access control in the Dropbox update service, dropboxupdate. It can be exploited by creating a specially crafted hard link, potentially allowing an attacker to elevate their privileges to the root level.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-65

Related Identifiers

BDU:2019-04834

Affected Products

Dropbox

References · 4

• https://bdu.fstec.ru/vul/2019-04834 · Security Note
• https://github.com/google/omaha/blob/4ff781228c319177e9b5d6195464eccf226f4a3c/omaha/base/logging.cc#L1000 · Note
• https://decoder.cloud/2019/12/18/from-dropboxupdater-to-nt-authoritysystem · Note
• https://xakep.ru/2019/12/25/dropbox-eop · Note