PT-2020-15141 · Oculus · Oculus Desktop

Published 2020-04-08 · Updated 2021-07-21 · CVE-2020-1885

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oculus Desktop versions prior to 1.44.0.32849

Description The issue allows local users to write to arbitrary files and gain privileges through vectors involving a hard link to a log file, by exploiting the ability of the OVRRedir.exe process to write to an unprivileged file.

Recommendations For versions prior to 1.44.0.32849, update to version 1.44.0.32849 or later to resolve the issue.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2020-1885

Affected Products

Oculus Desktop

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-1885 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1885 · Vendor Advisory
• https://facebook.com/security/advisories/cve-2020-1885 · Note