Improper input validation vulnerability in Secdo allows an authenticated local user with ‘create folders or append data’ access to the root of the OS disk (C:) to cause a system crash on every login. This issue affects all versions Secdo for Windows.

Recent assessments:

xFreed0m at April 10, 2020 3:07pm UTC reported:

CVE-2020-1986 Secdo: Local authenticated users can cause Windows system crash

Attack Vector LOCAL
Attack Complexity LOW
Privileges Required LOW
User Interaction NONE
Scope UNCHANGED
Confidentiality Impact NONE
Integrity Impact NONE
Availability Impact HIGH

Description

Improper input validation vulnerability in Secdo allows an authenticated local user with ‘create folders or append data’ access to the root of the OS disk (C:) to cause a system crash on every login. This issue affects all versions Secdo for Windows.

Product Status
Secdo
Versions Affected
all versions on Windows
Severity: MEDIUM
CVSSv3.1 Base Score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Solution

This product is no longer supported and the issue will not be fixed. This issue can be easily mitigated by creating a “C:\proc” folder and not allowing unprivileged users to access to that folder, or ensuring unprivileged users do not have ‘create folder’ access to the root of a disk (C:).

Workarounds and Mitigations

Exploitation of this issue can be prevented by creating a “C:\proc” folder and not allowing unprivileged users to access that folder.

Acknowledgements

We like to thank Eviatar Gerzi of CyberArk Labs Team for discovering and reporting this issue.

<https://security.paloaltonetworks.com/CVE-2020-1986&gt;

Assessed Attacker Value: 2
Assessed Attacker Value: 2Assessed Attacker Value: 4