Forescout CounterACT SecureConnector Agent on Windows access control

Summaryinfo

A vulnerability was found in Forescout CounterACT SecureConnector Agent on Windows. It has been classified as critical. This issue affects some unknown processing. Performing a manipulation results in access control. This vulnerability is known as CVE-2016-9486. Attacking locally is a requirement. No exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in Forescout CounterACT SecureConnector Agent on Windows (unknown version). This affects an unknown code block. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector agent runs various plugin scripts and executables on the endpoint in order to gather and report information about the host to the CounterACT management appliance. The SecureConnector agent downloads these scripts and executables as needed from the CounterACT management appliance and runs them on the endpoint. By default, these executable files are downloaded to and run from the %TEMP% directory of the currently logged on user, despite the fact that the SecureConnector agent is running as SYSTEM. Aside from the downloaded scripts, the SecureConnector agent runs a batch file with SYSTEM privileges from the temp directory of the currently logged on user. If the naming convention of this script can be derived, which is made possible by placing it in a directory to which the user has read access, it may be possible overwrite the legitimate batch file with a malicious one before SecureConnector executes it. It is possible to change this directory by setting the the configuration property config.script_run_folder.value in the local.properties configuration file on the CounterACT management appliance, however the batch file which is run does not follow this property.

The bug was discovered 12/07/2016. The weakness was published 07/13/2018 by Matt as confirmed advisory (CERT.org). It is possible to read the advisory at kb.cert.org. This vulnerability is uniquely identified as CVE-2016-9486 since 11/21/2016. The exploitability is told to be easy. Attacking locally is a requirement. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 583 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 94740†). Similar entry is available at VDB-121454. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Forescout

Name

• CounterACT SecureConnector Agent

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion