F-Secure SAFE Installer OLEACC.dll access control

Summaryinfo

A vulnerability marked as critical has been reported in F-Secure SAFE, Internet Security, Anti-Virus, Client Security, PSB Workstation Security and Computer Protection. This affects an unknown function of the file C:\Windows\Temp\OLEACC.dll of the component Installer. The manipulation leads to access control. This vulnerability is traded as CVE-2019-11644. An attack has to be approached locally. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in F-Secure SAFE, Internet Security, Anti-Virus, Client Security, PSB Workstation Security and Computer Protection (Anti-Malware Software). This issue affects an unknown code of the file C:\Windows\Temp\OLEACC.dll of the component Installer. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10, F-Secure PSB Workstation Security before 12.01, and F-Secure Computer Protection Standard and Premium before 19.3, a local user can escalate their privileges through a DLL hijacking attack against the installer. The installer writes the file rm.exe to C:\Windows\Temp and then executes it. The rm.exe process then attempts to load several DLLs from its current directory. Non-admin users are able to write to this folder, so an attacker can create a malicious C:\Windows\Temp\OLEACC.dll file. When an admin runs the installer, rm.exe will execute the attacker's DLL in an elevated security context.

The bug was discovered 05/16/2019. The weakness was shared 05/17/2019 (Website). The advisory is shared at f-secure.com. The identification of this vulnerability is CVE-2019-11644 since 05/01/2019. An attack has to be approached locally. A simple authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Anti-Malware Software

Vendor

• F-Secure

Name

• Anti-Virus
• Client Security
• Computer Protection
• Internet Security
• PSB Workstation Security
• SAFE

License

• commercial

Website

• Vendor: https://www.f-secure.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion