PT-2021-12816 · Proofpoint · Proofpoint Insider Threat Management Agent For Windows

Lee Christensen · Published 2021-01-06 · Updated 2021-01-13 · CVE-2020-8884

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Proofpoint Insider Threat Management Windows Agent versions prior to 7.9

Description: The issue allows remote authenticated users to execute arbitrary code as SYSTEM due to improper deserialization over named pipes in the rcdsvc component of the Proofpoint Insider Threat Management Windows Agent.

Recommendations: For versions prior to 7.9, update to version 7.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the named pipes used by the rcdsvc component to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-8884

Affected Products

Proofpoint Insider Threat Management Agent For Windows

References · 7

• https://osv.dev/vulnerability/CVE-2020-8884 · Vendor Advisory
• https://proofpoint.com/us/blog · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8884 · Security Note
• https://proofpoint.com/us/security/security-advisories/pfpt-sa-2020-0002 · Vendor Advisory
• https://t.me/cvenotify/8224 · Telegram Post
• https://t.me/cvenotify/8495 · Telegram Post
• https://t.me/cibsecurity/21655 · Telegram Post