CVE-2019-8452
HIGHCheck Point Endpoint Security < E80.96 and ZoneAlarm < 15.4.062 - Privilege Escalation via Hard Link
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-8452. PoCs published by Jakub Palaczynski.
AI-analyzed exploit summary This exploit leverages a privilege escalation vulnerability in Check Point Endpoint Security Client/ZoneAlarm by manipulating the tvDebug.log archiving mechanism to change permissions of arbitrary files, allowing an attacker to replace a DLL loaded with SYSTEM privileges.
Description
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file.
Exploits (1)
This exploit leverages a privilege escalation vulnerability in Check Point Endpoint Security Client/ZoneAlarm by manipulating the tvDebug.log archiving mechanism to change permissions of arbitrary files, allowing an attacker to replace a DLL loaded with SYSTEM privileges.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H