PT-2020-9122 · Thomson Reuters · Thomson Reuters Eikon

Khalil Bijjou · Published 2020-09-03 · Updated 2020-09-11 · CVE-2019-10679

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thomson Reuters Eikon version 4.0.42144

Description The issue allows all local users to modify the service executable file due to weak permissions in the %PROGRAMFILES(X86)%Thomson ReutersEikon directory.

Recommendations For Thomson Reuters Eikon version 4.0.42144, consider restricting access to the %PROGRAMFILES(X86)%Thomson ReutersEikon directory to prevent modification of the service executable file until a patch is available.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2019-10679

Affected Products

Thomson Reuters Eikon

References · 8

• 🔥 http://seclists.org/fulldisclosure/2020/Aug/19 · Exploit
• 🔥 http://packetstormsecurity.com/files/158989/Eikon-Thomson-Reuters-4.0.42144-File-Permissions.html · Exploit
• https://thomsonreuters.com/en/products-services.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10679 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10679 · Vendor Advisory
• https://sec-consult.com/en/blog/advisories/extensive-file-permissions-on-service-executable-in-eikon-thomson-reuters-cve-2019-10679 · Note
• https://t.me/cibsecurity/14456 · Telegram Post
• https://sec-consult.com/en/vulnerability-lab/advisories/index.html · Note