MNDT-2022-0031
Description
Oracle Crystal Ball for Windows contains a local privilege escalation vulnerability which affected version 11.1.2.0.0 - 11.1.2.4.900.
Impact
High - Exploiting the vulnerability will give a local unprivileged attacker SYSTEM level privileges.
Exploitability
Medium - Any authenticated local user can exploit the vulnerability and an exploit is trivial to produce.
CVE Reference
CVE-2022-21558
Common Weakness Enumeration
CWE-379: Creation of Temporary File in Directory with Insecure Permissions
Common Vulnerability Scoring System
Base Score: 7.8 - Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Technical Details
The installation of the agent uses the Windows Installer framework and an MSI file is cached in c:\windows\installer. An unprivileged user can trigger a repair operation, either by using the Windows Installer API or by running "msiexec.exe /fa c:\windows\installer\[XXXXX].msi".
Running a repair operation will trigger a number of file operations in the %TEMP% folder of the user triggering the repair. Some of these operations will be performed from a SYSTEM context (started via the Windows Installer service), including the execution of temporary files.
Resolution
The issue was fixed with the July 2022 Critical Patch Update. Update to address the vulnerability.
Discovery Credits
- Ronnie Salomonsen, Mandiant
Disclosure Timeline
- 29-Sep-2021 - Issue reported to Oracle
- 06-May-2022 - Issue confirmed by Oracle and a fix scheduled for July 19, 2022.
- 19-Jul-2022 - Patched version released by Oracle