Hasomed Elefant prior 1.4.2.1811 Update Service PostESUUpdate.exe toctou

Summaryinfo

A vulnerability, which was classified as critical, has been found in Hasomed Elefant. The impacted element is an unknown function of the file PostESUUpdate.exe of the component Update Service. This manipulation causes toctou. This vulnerability appears as CVE-2024-50592. In addition, an exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Hasomed Elefant. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file PostESUUpdate.exe of the component Update Service. The manipulation with an unknown input leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using the repair function, the service queries the server for a list of files and their hashes. In addition, instructions to execute binaries to finalize the repair process are included. The executables are executed as "NT AUTHORITY\SYSTEM" after they are copied over to the user writable installation folder (C:\Elefant1). This means that a user can overwrite either "PostESUUpdate.exe" or "Update_OpenJava.exe" in the time frame after the copy and before the execution of the final repair step. The overwritten executable is then executed as "NT AUTHORITY\SYSTEM".

The weakness was presented by Tobias Niemann. It is possible to read the advisory at r.sec-consult.com. This vulnerability is known as CVE-2024-50592 since 10/25/2024. The exploitation appears to be difficult. Technical details and also a public exploit are known.

It is possible to download the exploit at packetstormsecurity.com. It is declared as proof-of-concept.

Upgrading to version 1.4.2.1811 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Hasomed

Name

• Elefant

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion