PT-2021-18776 · Google · Chromeos Readiness Tool

Published 2021-09-08 · Updated 2021-09-15 · CVE-2021-30605

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChromeOS Readiness Tool versions prior to 1.0.2.0

Description The issue is related to an inappropriate implementation in the ChromeOS Readiness Tool installer on Windows, which loosens DCOM access rights on two objects. This could allow an attacker to potentially bypass discretionary access controls.

Recommendations For versions prior to 1.0.2.0, update to version 1.0.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected DCOM objects to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-30605

Affected Products

Chromeos Readiness Tool

References · 5

• https://osv.dev/vulnerability/CVE-2021-30605 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30605 · Security Note
• https://bit.ly/37CS6G9 · Note
• https://crbug.com/1240952 · Note
• https://t.me/cibsecurity/28540 · Telegram Post