Electronic Arts Origin 10.5.55.33574 DACL Origin.exe WriteFileEx Named Pipe privileges management

Summaryinfo

A vulnerability, which was classified as critical, has been found in Electronic Arts Origin 10.5.55.33574. This affects the function WriteFileEx in the library libeay32.dll of the file Origin.exe of the component DACL Handler. The manipulation as part of Named Pipe leads to privileges management. This vulnerability is traded as CVE-2019-19741. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Electronic Arts Origin 10.5.55.33574. It has been rated as critical. This issue affects the function WriteFileEx in the library libeay32.dll of the file Origin.exe of the component DACL Handler. The manipulation as part of a Named Pipe leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and CVE-2019-19248. When Origin.exe connects to the named pipe OriginClientService, the privileged service verifies the client's executable file instead of its in-memory process (which can be significantly different from the executable file due to, for example, DLL injection). Data transmitted over the pipe is encrypted using a static key. Instead of hooking the pipe communication directly via WriteFileEx(), this can be bypassed by hooking the EVP_EncryptUpdate() function of libeay32.dll. The pipe takes the command CreateDirectory to create a directory and adjust the directory DACL. Calls to this function can be intercepted, the directory and the DACL can be replaced, and the manipulated DACL is written. Arbitrary DACL write is further achieved by creating a hardlink in a user-controlled directory that points to (for example) a service binary. The DACL is then written to this service binary, which results in escalation of privileges.

The weakness was shared 02/20/2020. The identification of this vulnerability is CVE-2019-19741 since 12/12/2019. The exploitation is known to be easy. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Electronic Arts

Name

• Origin

Version

• 10.5.55.33574

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion