SB2020013009 - Multiple vulnerabilities in IXP EasyInstall
Published: January 30, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Cleartext transmission of sensitive information (CVE-ID: CVE-2019-19898)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to software uses insecure communication channel to transmit sensitive information to the IXP server instance during login. A remote attacker with ability to intercept network traffic can gain access to sensitive data.
2) Input validation error (CVE-ID: CVE-2019-19894)
The vulnerability allows a remote attacker to temporarily disable UAC.
The vulnerability exists due to insufficient validation of user-supplied input. A remote authenticated attacker can disable UAC for other users by renaming and replacing "%SYSTEMDRIVE%IXPDATAIXPAS.IXP".
3) Path traversal (CVE-ID: CVE-2019-19893)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences on TCP port 8000 via the Engine Service. A remote attacker, who can access the server's filesystem with the access rights of "NT AUTHORITYSYSTEM", can send a specially crafted HTTP request and read arbitrary files on the system.
4) Incorrect default permissions (CVE-ID: CVE-2019-19896)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to weak permissions on the Engine Service share. The default file permissions of the IXP$ share on the server allows
modification of directories and files (e.g., bat-scripts), which allows remote authenticated attacker to execute arbitrary code in the context of "NT AUTHORITYSYSTEM" on the target
server and clients.
5) Code Injection (CVE-ID: CVE-2019-19897)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in the Agent Service. A remote attacker can communicate with the Agent Service over TCP port 20051 and execute arbitrary code in the "NT AUTHORITYSYSTEM" context of the target system by using the Execute Command Line function.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Input validation error (CVE-ID: CVE-2019-19895)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to the Lateral Movement (using the Agent Service) against other users on a client system. A remote authenticated attacker can modify "%SYSTEMDRIVE%IXPSW[PACKAGE_CODE]EveryLogon.bat" to achieve this movement and execute code in the context of other users.
Remediation
Install update from vendor's website.