SB2019120347 - Multiple vulnerabilities in Druva inSync Client
Published: December 3, 2019 Updated: November 30, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) OS Command Injection (CVE-ID: CVE-2019-3999)
The vulnerability allows a local user to execute arbitrary shell commands on the target system with elevated privileges.
The vulnerability exists due to improper input validation in Windows Druva inSync Client Service (inSyncCPHwnet64.exe) when processing RPC requests. A local user can pass specially crafted data to the application to port 6064/tcp and execute arbitrary OS commands with SYSTEM privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Code Injection (CVE-ID: CVE-2019-4000)
The vulnerability allows a local user to execute arbitrary code on the target system with elevated privileges.
The vulnerability exists due to improper input validation within the daemon.set_file_acl() method in inSyncDecommission. A local user can send a specially crafted RPC request to port 6059/tcp and execute arbitrary code on the target system with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Code Injection (CVE-ID: CVE-2019-4001)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation. The inSync Electron application is configured in such a way that a malicious local user can execute arbitrary NodeJS code in the context of the inSync client process. An attacker can accomplish this by launching inSync with a URL parameter pointing to an attacker-controlled HTML file containing NodeJS code.
Remediation
Install update from vendor's website.