PT-2024-34345 · Microsoft · Windows

Daniel Hirschberger + 2 · Published 2024-11-08 · Updated 2024-11-08 · CVE-2024-50590

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Elefant (affected versions not specified)

Description: Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITYSYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:Elefant1" which is writable for all users. In addition, the Elefant installer registers two Firebird database services which are running as “NT AUTHORITYSYSTEM”. Both service binaries are user writable, allowing a local attacker to rename one of the service binaries, replace the service executable with a new executable, and then restart the system. Once the system has rebooted, the new service binary is executed as "NT AUTHORITYSYSTEM". The vulnerable service binaries are located at "C:Elefant1Firebird 2binfbserver.exe" and "C:Elefant1Firebird 2binfbguard.exe".

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Incorrect Permission

Weakness Enumeration

CWE-276

CWE-250

CWE-732

Related Identifiers

CVE-2024-50590

Affected Products

Windows

References · 8

• https://hasomed.de/produkte/elefant · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-50590 · Security Note
• https://twitter.com/VulmonFeeds/status/1855018618561433963 · Twitter Post
• https://t.me/cvenotify/101051 · Telegram Post
• https://t.me/cvedetector/10197 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Nov/3 · Note
• https://twitter.com/CVEnew/status/1854863976665862158 · Twitter Post
• https://r.sec-consult.com/hasomed · Note