CVE-2020-24955

SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivileged users to restore a malicious DLL from quarantine into the system32 folder via an NTFS directory junction, as demonstrated by a crafted ualapi.dll file that is detected as malware.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/b1nary0x1	Third Party Advisory
https://www.youtube.com/watch?v=jdcqbev-H5I	Exploit Third Party Advisory
https://github.com/b1nary0x1	Third Party Advisory
https://www.youtube.com/watch?v=jdcqbev-H5I	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:superantispyware:professional_x:*:*:*:*:trial:*:*:*

History

21 Nov 2024, 05:16

Type	Values Removed	Values Added
References	~~() https://github.com/b1nary0x1 - Third Party Advisory~~	() https://github.com/b1nary0x1 - Third Party Advisory
References	~~() https://www.youtube.com/watch?v=jdcqbev-H5I - Exploit, Third Party Advisory~~	() https://www.youtube.com/watch?v=jdcqbev-H5I - Exploit, Third Party Advisory

Information

Published : 2020-09-01 22:15

Updated : 2024-11-21 05:16

NVD link : CVE-2020-24955

Mitre link : CVE-2020-24955

CVE.ORG link : CVE-2020-24955

JSON object : View

Products Affected

superantispyware

professional_x

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2020-24955", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-09-01T22:15:10.250", "references": [{"url": "https://github.com/b1nary0x1", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.youtube.com/watch?v=jdcqbev-H5I", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/b1nary0x1", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.youtube.com/watch?v=jdcqbev-H5I", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivileged users to restore a malicious DLL from quarantine into the system32 folder via an NTFS directory junction, as demonstrated by a crafted ualapi.dll file that is detected as malware."}, {"lang": "es", "value": "SUPERAntiSyware Professional X Trial versi\u00f3n 10.0.1206, es vulnerable a una escalada de privilegios local porque permite a usuarios no privilegiado restaurar una DLL maliciosa de la cuarentena en la carpeta system32 por medio de una uni\u00f3n de directorio NTFS, como es demostrado por un archivo ualapi.dll dise\u00f1ado que es detectado como malware"}], "lastModified": "2024-11-21T05:16:15.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:superantispyware:professional_x:*:*:*:*:trial:*:*:*", "vulnerable": true, "matchCriteriaId": "22D1769B-8237-453E-92F3-41883A26C629", "versionEndExcluding": "10.0.1206"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}