SB2020051813 - Privilege escalation in Cellebrite UFED

Description

This security bulletin contains information about 1 vulnerability.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-12798)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the affected software implements local operating system policies that can be circumvented to obtain a command prompt via the Windows file dialog that is reachable via the Certificate-Based Authentication option of the Wireless Network Connection screen. A remote attacker can gain elevated privileges on the target system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://packetstormsecurity.com/files/157715/Cellebrite-UFED-7.5.0.845-Desktop-Escape-Privilege-Escalation.html
• https://github.com/thatguylevel
• https://korelogic.com/advisories.html
• https://korelogic.com/Resources/Advisories/KL-001-2020-002.txt
• https://twitter.com/thatguylevel