Hasomed Elefant 1.4.2.1811/24.03.03 fbserver.exe default permission

Summaryinfo

A vulnerability described as critical has been identified in Hasomed Elefant. This issue affects some unknown processing of the file C:\Elefant1\Firebird_2\bin\fbserver.exe. Executing a manipulation can lead to default permission. This vulnerability is registered as CVE-2024-50590. The attack needs to be launched locally. Furthermore, an exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Hasomed Elefant and classified as critical. This vulnerability affects an unknown code block of the file C:\Elefant1\Firebird_2\bin\fbserver.exe. The manipulation with an unknown input leads to a default permission vulnerability. The CWE definition for the vulnerability is CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is writable for all users. In addition, the Elefant installer registers two Firebird database services which are running as “NT AUTHORITY\SYSTEM”.  Path: C:\Elefant1\Firebird_2\bin\fbserver.exe Path: C:\Elefant1\Firebird_2\bin\fbguard.exe Both service binaries are user writable. This means that a local attacker can rename one of the service binaries, replace the service executable with a new executable, and then restart the system. Once the system has rebooted, the new service binary is executed as "NT AUTHORITY\SYSTEM".

The weakness was published by Tobias Niemann. The advisory is shared for download at r.sec-consult.com. This vulnerability was named CVE-2024-50590 since 10/25/2024. The exploitation appears to be easy. The attack needs to be approached locally. Technical details and also a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1222.

It is possible to download the exploit at packetstormsecurity.com. It is declared as proof-of-concept.

Upgrading to version 24.04.00 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Hasomed

Name

• Elefant

Version

• 1.4.2.1811
• 24.03.03

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion