CVE-2019-3567
High
Description
In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known 'safe' permissions. Under those circumstances osquery will load said malicious executable with SYSTEM permissions. The solution is to migrate installations to the 'Program Files' directory on Windows which restricts unprivileged write access. This issue affects osquery prior to v3.4.0.
SeverityHigh
CVSS8.1
Exploit probability—
ProductLinuxfoundation Osquery
PublishedJun 3, 2019
First seenJun 3, 2019
Weakness typeCWE-284Improper access control
How to fix
Update
- linuxfoundation osquery3.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation osquery | v < 3.4.0 | 3.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.