In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10, F-Secure PSB Workstation Security before 12.01, and F-Secure Computer Protection Standard and Premium before 19.3, a local user can escalate their privileges through a DLL hijacking attack against the installer. The installer writes the file rm.exe to C:\Windows\Temp and then executes it. The rm.exe process then attempts to load several DLLs from its current directory. Non-admin users are able to write to this folder, so an attacker can create a malicious C:\Windows\Temp\OLEACC.dll file. When an admin runs the installer, rm.exe will execute the attacker's DLL in an elevated security context.
2019-05-17T21:29:00.293
2024-11-21T04:21:31.240
Modified
CVSSv3.0: 7.8 (HIGH)
AV:N/AC:M/Au:N/C:P/I:P/A:P
8.6
6.4
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | f-secure | client_security | < 14.10 | Yes |
| Application | f-secure | client_security | < 14.10 | Yes |
| Application | f-secure | computer_protection | < 19.3 | Yes |
| Application | f-secure | computer_protection | < 19.3 | Yes |
| Application | f-secure | internet_security | < 17.6 | Yes |
| Application | f-secure | psb_workstation_security | < 12.01 | Yes |
| Application | f-secure | safe | < 17.6 | Yes |