CVE-2016-20033: Wowza Streaming Engine 4.5.0 Local Privilege Escalation via nssm_x64.exe
Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users to escalate privileges by replacing executable files due to improper file permissions granting full access to the Everyone group. Attackers can replace the nssmx64.exe binary in the manager and engine service directories with malicious executables to execute code with LocalSystem privileges when services restart.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-20033?
CVE-2016-20033 is classified as a local privilege escalation vulnerability.
How do I fix CVE-2016-20033?
To fix CVE-2016-20033, update Wowza Streaming Engine to a version that addresses the privilege escalation issue.
Who is affected by CVE-2016-20033?
Authenticated users of Wowza Streaming Engine 4.5.0 are affected by CVE-2016-20033.
What allows the exploitation of CVE-2016-20033?
CVE-2016-20033 can be exploited due to improper file permissions on executable files.
What does CVE-2016-20033 impact?
CVE-2016-20033 impacts the Wowza Streaming Engine, allowing privilege escalation for authenticated users.