Advisory Details

July 23rd, 2024

(0Day) Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability

ZDI-24-955
ZDI-CAN-22829

CVE ID CVE-2024-7250
CVSS SCORE 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS Comodo
AFFECTED PRODUCTS Internet Security Pro
VULNERABILITY DETAILS

This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.

ADDITIONAL DETAILS

02/02/24 – ZDI submitted the vulnerability report to Xcitium Support team
04/30/24 – ZDI asked for updates
05/01/24 – Xcitium’s support team rejected the report and advised ZDI to resubmit the report Comodo’s GeekBuddy Support team
05/03/24 – ZDI resubmitted the report Comodo’s GeekBuddy Support team
07/12/24 – ZDI asked for updates
07/12/24 - Comodo’s GeekBuddy Support team asked ZDI to submit the false positive file to Comodo’s Malware Analysis team
07/12/24 – ZDI notified the vendor of the intention to publish the cases as 0-day advisory

-- Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application.


DISCLOSURE TIMELINE
  • 2024-02-02 - Vulnerability reported to vendor
  • 2024-07-23 - Coordinated public release of advisory
  • 2024-08-15 - Advisory Updated
CREDIT Anonymous
BACK TO ADVISORIES