Multiple vulnerabilities in Palo Alto Secdo for Windows



Risk Low
Patch available NO
Number of vulnerabilities 3
CVE-ID CVE-2020-1984
CVE-2020-1985
CVE-2020-1986
CWE-ID CWE-73
CWE-276
CWE-20
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Secdo
Client/Desktop applications / Other client software

Vendor Palo Alto Networks, Inc.

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) External Control of File Name or Path

EUVDB-ID: #VU26735

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-1984

CWE-ID: CWE-73 - External Control of File Name or Path

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the target system.

Thevulnerability exists due to the affected software tries to execute a script at a hardcoded path if present. A local user with "create folders or append data" access to the root of the OS disk (C:\) can gain system privileges if the path does not already exist or is writable. 

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Secdo: All versions

CPE2.3 External links

https://security.paloaltonetworks.com/CVE-2020-1984


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Incorrect default permissions

EUVDB-ID: #VU26736

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-1985

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions on "C:\Programdata\Secdo\Logs" folder. A local user can overwrite system files and gain elevated privileges on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Secdo: All versions

CPE2.3 External links

https://security.paloaltonetworks.com/CVE-2020-1985


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU26737

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-1986

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A local user with "create folders or append data" access to the root of the OS disk (C:\) can cause a system crash on every login.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Secdo: All versions

CPE2.3 External links

https://security.paloaltonetworks.com/CVE-2020-1986


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###