high8.8
CVE-2022-41604
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges.
Impact
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows creation of a junction directory. This can be leveraged to perform an arbitrary file move as NT AUTHORITY\SYSTEM.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Checkpoint | Zonealarm | before 15.8.211.19229 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Wh04m1001/ZoneAlarmEoP
- https://www.infigo.hr/en/insights/39/elevation-of-privilege-in-zonealarm-extreme-security/
- https://www.zonealarm.com/software/extreme-security/release-history
- https://github.com/Wh04m1001/ZoneAlarmEoP
- https://www.infigo.hr/en/insights/39/elevation-of-privilege-in-zonealarm-extreme-security/
- https://www.zonealarm.com/software/extreme-security/release-history