CVE-2017-7884

In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM privileges at startup. This occurs because of "RW NT AUTHORITY\Authenticated Users" permissions for %SYSTEMDRIVE%\apcupsd\bin\apcupsd.exe.

CVSS v3 8.4 HIGH
CVSS v2.0 7.2 HIGH

8.4^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://seclists.org/fulldisclosure/2017/Jun/20	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/99092	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038707
http://seclists.org/fulldisclosure/2017/Jun/20	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/99092	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038707

Configurations

Configuration 1 (hide)

cpe:2.3:a:apcupsd:apc_ups_daemon:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:32

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2017/Jun/20 - Mailing List, Third Party Advisory~~	() http://seclists.org/fulldisclosure/2017/Jun/20 - Mailing List, Third Party Advisory
References	~~() http://www.securityfocus.com/bid/99092 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/99092 - Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1038707 -~~	() http://www.securitytracker.com/id/1038707 -

Information

Published : 2017-06-16 13:29

Updated : 2024-11-21 03:32

NVD link : CVE-2017-7884

Mitre link : CVE-2017-7884

CVE.ORG link : CVE-2017-7884

JSON object : View

Products Affected

apcupsd

apc_ups_daemon

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2017-7884", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "published": "2017-06-16T13:29:00.187", "references": [{"url": "http://seclists.org/fulldisclosure/2017/Jun/20", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/99092", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1038707", "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2017/Jun/20", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/99092", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1038707", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM privileges at startup. This occurs because of \"RW NT AUTHORITY\\Authenticated Users\" permissions for %SYSTEMDRIVE%\\apcupsd\\bin\\apcupsd.exe."}, {"lang": "es", "value": "En Demonio APC UPS hasta versi\u00f3n 3.14.14 de Adam Kropelin adk0212 , la instalaci\u00f3n por defecto de APCUPSD permite que un usuario identificado local, pero no privilegiado, ejecute c\u00f3digo arbitrario con privilegios elevados al reemplazar el servicio ejecutable apcupsd.exe con un ejecutable malicioso que se ejecutar\u00e1 con privilegios SYSTEM en el inicio. Esto ocurre debido a los permisos \"RW NT AUTHORITY\\Authenticated Users\" para %SYSTEMDRIVE%\\apcupsd\\bin\\apcupsd.exe."}], "lastModified": "2024-11-21T03:32:53.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apcupsd:apc_ups_daemon:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58E8B12B-0578-4783-9B68-3E6BAEBF7EA0", "versionEndIncluding": "3.14.14"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}