Link following in Check Point Harmony Endpoint and ZoneAlarm Extreme Security

1) Link following

EUVDB-ID: #VU84987

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-28134

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a link following issue within the Remediation Service. A local user can abuse the service to change the DACL on a folder, which leads to security restrictions bypass and privilege escalation.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Harmony Endpoint: E84.0 - E86.0

ZoneAlarm Extreme Security: All versions

CPE2.3

• cpe:2.3:a:check_point_software_technologies:harmony_endpoint:E84.0:*:*:*:*:*:*:*
• cpe:2.3:a:check_point_software_technologies:harmony_endpoint:E85.0:*:*:*:*:*:*:*
• cpe:2.3:a:check_point_software_technologies:harmony_endpoint:E86.0:*:*:*:*:*:*:*
• cpe:2.3:a:check_point_software_technologies:zonealarm_extreme_security:*:*:*:*:*:*:*:*

External links

https://support.checkpoint.com/results/sk/sk181597
https://www.zerodayinitiative.com/advisories/ZDI-23-1764/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.