CVE-2020-36166

{"id": "CVE-2020-36166", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}, {"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.5}]}, "published": "2021-01-06T01:15:13.120", "references": [{"url": "https://www.veritas.com/content/support/en_US/security/VTS20-014", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Veritas InfoScale 7.x through 7.4.2 on Windows, Storage Foundation through 6.1 on Windows, Storage Foundation HA through 6.1 on Windows, and InfoScale Operations Manager (aka VIOM) Windows Management Server 7.x through 7.4.2. On start-up, it loads the OpenSSL library from \\usr\\local\\ssl. This library attempts to load the \\usr\\local\\ssl\\openssl.cnf configuration file, which may not exist. On Windows systems, this path could translate to <drive>:\\usr\\local\\ssl\\openssl.cnf, where <drive> could be the default Windows installation drive such as C:\\ or the drive where a Veritas product is installed. By default, on Windows systems, users can create directories under any top-level directory. A low privileged user can create a <drive>:\\usr\\local\\ssl\\openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Veritas InfoScale versiones 7.x hasta 7.4.2 en Windows, Storage Foundation versiones hasta 6.1 en Windows, Storage Foundation HA versiones hasta 6.1 en Windows e InfoScale Operations Manager (tambi\u00e9n se conoce como VIOM) Windows Management Server versiones 7.x hasta 7.4.2 .&#xa0;Al iniciarse, carga la biblioteca OpenSSL desde \\usr\\local\\ssl.&#xa0;Esta biblioteca intenta cargar el archivo de configuraci\u00f3n \\usr\\local\\ssl\\openssl.cnf, que puede no estar presente.&#xa0;En los sistemas Windows, esta ruta podr\u00eda traducirse a (drive):\\usr\\local\\ssl\\openssl.cnf, donde (drive) podr\u00eda ser la unidad de instalaci\u00f3n predeterminada de Windows, como C:\\ o la unidad donde est\u00e1 instalado un producto de Veritas.&#xa0;Por defecto, en los sistemas Windows, los usuarios pueden crear directorios en cualquier directorio de nivel superior.&#xa0;Un usuario poco privilegiado puede crear un archivo de configuraci\u00f3n (drive):\\usr\\local\\ssl\\openssl.cnf para cargar un motor OpenSSL malicioso, resultando en una ejecuci\u00f3n de c\u00f3digo arbitraria como SYSTEM cuando se inicia el servicio.&#xa0;Esto le otorga al atacante acceso de administrador al sistema, permitiendo al atacante (por defecto) acceder a todos los datos, acceder a todas las aplicaciones instaladas, etc"}], "lastModified": "2021-01-12T19:22:51.687", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:veritas:infoscale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C5CA35E-248F-44E2-A4E5-FD33422E8EA8", "versionEndIncluding": "7.4.2", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:veritas:infoscale_operations_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91E5814D-0C90-480F-A154-D199AF6B7EF4", "versionEndIncluding": "7.4.2", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:veritas:storage_foundation:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CDDBD0A-1513-48DB-B8D1-D61F458B78F8", "versionEndIncluding": "6.1"}, {"criteria": "cpe:2.3:a:veritas:storage_foundation_and_high_availability:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD526F29-512A-4713-86E1-878755557B29", "versionEndIncluding": "6.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}