PT-2024-20077 · Quest · Quest Kace Agent For Windows

Tom Norfolk · Published 2024-04-30 · Updated 2024-08-09 · CVE-2024-23773

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quest KACE Agent for Windows versions 12.0.38 through 13.1.23.0

Description An issue exists in the KSchedulerSvc.exe component, allowing local attackers to delete any file of their choice with NT AuthoritySYSTEM privileges. This is due to an arbitrary file delete vulnerability.

Recommendations For version 12.0.38, consider disabling the KSchedulerSvc.exe component until a patch is available. For version 13.1.23.0, restrict access to the KSchedulerSvc.exe component to minimize the risk of exploitation. As a temporary workaround, consider implementing additional access controls to limit the privileges of the NT AuthoritySYSTEM account.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-23773

Affected Products

Quest Kace Agent For Windows

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-23773 · Security Note
• https://twitter.com/VulmonFeeds/status/1785354230892470617 · Twitter Post
• https://t.me/cvenotify/90070 · Telegram Post
• https://t.me/cvenotify/78593 · Telegram Post
• https://quest.com/kace · Note
• https://twitter.com/CVEnew/status/1785311884834390281 · Twitter Post
• https://support.quest.com/kb/4375402/quest-response-to-kace-sma-agent-vulnerabilities-cve-2024-23772-cve-2024-23773-cve-2024-23774 · Note
• https://t.me/cvenotify/78591 · Telegram Post
• https://t.me/cvenotify/78592 · Telegram Post