PT-2022-17105 · Itarian · Itarian Endpoint Manage Communication Client

Frank Breedijk + 5 · Published 2022-06-08 · Updated 2024-01-02 · CVE-2022-25153

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ITarian Endpoint Manage Communication Client versions prior to 6.43.41148.21120

Description The issue is related to the ITarian Endpoint Manage Communication Client being compiled with insecure OpenSSL settings. This allows a malicious actor with low privileges access to a system to escalate their privileges to SYSTEM by abusing an insecure openssl.conf lookup.

Recommendations For versions prior to 6.43.41148.21120, update to version 6.43.41148.21120 or later to resolve the issue. As a temporary workaround, consider restricting access to the openssl.conf file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-275

Related Identifiers

CVE-2022-25153

Affected Products

Itarian Endpoint Manage Communication Client

References · 5

• https://osv.dev/vulnerability/CVE-2022-25153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25153 · Security Note
• https://t.me/cvenotify/31366 · Telegram Post
• https://csirt.divd.nl/CVE-2022-25153 · Note
• https://csirt.divd.nl/DIVD-2021-00037 · Note