PT-2020-14383 · Idrive · I-Drive

Hashim Jawad · Published 2020-06-26 · Updated 2020-07-06 · CVE-2020-15351

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IDrive versions prior to 6.7.3.19

Description The issue allows any standard user to escalate privileges to NT AUTHORITYSYSTEM by substituting the IDriveService binary with a malicious one due to weak folder permissions. The program installs by default to %PROGRAMFILES(X86)%IDriveWindows with permissions granting any user modify permission to the directory and its sub-folders. The IDriveService runs as LocalSystem, enabling privilege escalation.

Recommendations For versions prior to 6.7.3.19, update to version 6.7.3.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the IDriveService binary to prevent substitution with a malicious one. Additionally, review and adjust the folder permissions of the %PROGRAMFILES(X86)%IDriveWindows directory to prevent unauthorized modifications.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-15351

Affected Products

I-Drive

References · 5

• https://idrive.com/release-info#win · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15351 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15351 · Vendor Advisory
• https://github.com/active-labs/Advisories/blob/master/2020/ACTIVE-2020-004.md · Note
• https://t.me/cvenotify/4679 · Telegram Post