PT-2022-7274 · Check Point · Check Point Endpoint Security Client

Published 2022-05-12 · Updated 2022-05-23 · CVE-2022-23742

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Check Point Endpoint Security Client for Windows versions earlier than E86.40

Description The issue is related to incorrect handling of symbolic links before accessing a file, which can allow an attacker to replace arbitrary files in the system and execute arbitrary code. An attacker can exploit this by replacing files with malicious content, such as using symbolic links, in a directory with low privileges where files for forensics reports are copied from.

Recommendations For versions earlier than E86.40, update to version E86.40 or later to resolve the issue. As a temporary workaround, consider restricting access to the directory where files for forensics reports are copied from to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-65

CWE-59

Related Identifiers

BDU:2024-01725

CVE-2022-23742

Affected Products

Check Point Endpoint Security Client

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-23742 · Security Note
• https://bdu.fstec.ru/vul/2024-01725 · Security Note
• https://supportcontent.checkpoint.com/solutions?id=sk179132 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23742 · Vendor Advisory
• https://support.checkpoint.com/results/sk/sk179132 · Note
• https://supportcontent.checkpoint.com/solutions?id=sk178665%2C · Note
• https://t.me/cibsecurity/42569 · Telegram Post