Heimdal Pro 2.2.190 Permission Heimdal Agent access control

Summaryinfo

A vulnerability was found in Heimdal Pro 2.2.190. It has been classified as critical. Affected by this vulnerability is an unknown functionality in the library version.dll of the file C:\ProgramData\Heimdal Security\Heimdal Agent of the component Permission. The manipulation leads to access control. This vulnerability is uniquely identified as CVE-2018-5349. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability was found in Heimdal Pro 2.2.190 and classified as critical. This issue affects an unknown code block in the library version.dll of the file C:\ProgramData\Heimdal Security\Heimdal Agent of the component Permission. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability has been found in Heimdal PRO v2.2.190, but it is most likely also present in Heimdal FREE and Heimdal CORP. Faulty permissions on the directory "C:\ProgramData\Heimdal Security\Heimdal Agent" allow BUILTIN\Users to write new files to the directory. On startup, the process Heimdal.MonitorServices.exe running as SYSTEM will attempt to load version.dll from this directory. Placing a malicious version.dll in this directory will result in privilege escalation. NOTE: any affected Heimdal products are completely unrelated to the Heimdal vendor of a Kerberos 5 product on the h5l.org web site.

The bug was discovered 03/12/2018. The weakness was disclosed 03/22/2018 (Website). The advisory is shared at improsec.com. The identification of this vulnerability is CVE-2018-5349 since 01/11/2018. An attack has to be approached locally. The requirement for exploitation is a simple authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 10 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Heimdal Pro

Version

• 2.2.190

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion