I2P up to 0.9.45 I2PSvc.exe default permission

Summaryinfo

A vulnerability was found in I2P up to 0.9.45. It has been classified as critical. Impacted is an unknown function of the file I2PSvc.exe. Performing a manipulation results in default permission. This vulnerability is reported as CVE-2020-13431. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in I2P up to 0.9.45. It has been classified as critical. This affects an unknown code block of the file I2PSvc.exe. The manipulation with an unknown input leads to a default permission vulnerability. CWE is classifying the issue as CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

I2P before 0.9.46 allows local users to gain privileges via a Trojan horse I2PSvc.exe file because of weak permissions on a certain %PROGRAMFILES% subdirectory.

The weakness was disclosed 06/16/2020. This vulnerability is uniquely identified as CVE-2020-13431 since 05/24/2020. An attack has to be approached locally. The requirement for exploitation is a authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

Upgrading to version 0.9.46 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• I2P

Version

• 0.9.0
• 0.9.1
• 0.9.2
• 0.9.3
• 0.9.4
• 0.9.5
• 0.9.6
• 0.9.7
• 0.9.8
• 0.9.9
• 0.9.10
• 0.9.11
• 0.9.12
• 0.9.13
• 0.9.14
• 0.9.15
• 0.9.16
• 0.9.17
• 0.9.18
• 0.9.19
• 0.9.20
• 0.9.21
• 0.9.22
• 0.9.23
• 0.9.24
• 0.9.25
• 0.9.26
• 0.9.27
• 0.9.28
• 0.9.29
• 0.9.30
• 0.9.31
• 0.9.32
• 0.9.33
• 0.9.34
• 0.9.35
• 0.9.36
• 0.9.37
• 0.9.38
• 0.9.39
• 0.9.40
• 0.9.41
• 0.9.42
• 0.9.43
• 0.9.44
• 0.9.45

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion