Matthew Hyde

The issue concerns the SecureConnector agent's handling of downloaded files. When the agent downloads plugin scripts and executables from the CounterACT management appliance, it fails to set any permissions on these files. This allows a malicious user to take ownership of the files, modify them, and then have them executed under SYSTEM privileges. A malicious unprivileged user can overwrite the executable files with malicious code before the SecureConnector agent executes them, resulting in the malicious code being run under the SYSTEM account.

The SecureConnector agent runs under the local SYSTEM account and executes plugin scripts and executables on the endpoint to gather and report information to the CounterACT management appliance. These executable files are downloaded to and run from the %TEMP% directory of the currently logged on user. A batch file with SYSTEM privileges is run from this temp directory. If the naming convention of this script can be derived, it may be possible to overwrite the legitimate batch file with a malicious one before execution. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.