CVE-2016-20088: Comodo Chromodo Browser 52.15.25.664 Unquoted Service Path Privilege Escalation
Comodo Chromodo Browser 52.15.25.664 contains an unquoted service path vulnerability in the ChromodoUpdater service that runs with SYSTEM privileges. A local attacker can insert a malicious executable in the service path and execute arbitrary code with elevated privileges upon service restart or system reboot.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Edit the ChromodoUpdater service ImagePath to wrap the full executable path in double quotes. Update the registry value at HKLM\SYSTEM\CurrentControlSet\Services\ChromodoUpdater (ImagePath) or use 'sc config' to set the ImagePath to the quoted full path to prevent unquoted service path exploitation.
ChromodoUpdater service ImagePath = Enclose the full path to the service executable in double quotes (e.g., "C:\Program Files\Chromodo\ChromodoUpdater.exe") - Compensating control
Restrict NTFS write permissions on the ChromodoUpdater executable directory and all parent directories so that only Administrators and SYSTEM have write access, preventing local users from placing a malicious executable into the service path.
- Operational
After changing the ImagePath or permissions, restart the ChromodoUpdater service (or reboot the system) so the corrected service configuration and permissions take effect.
Event History
Frequently Asked Questions
What is the severity of CVE-2016-20088?
The severity of CVE-2016-20088 is high with a score of 8.5.
How does CVE-2016-20088 affect the Comodo Chromodo Browser?
CVE-2016-20088 allows a local attacker to exploit an unquoted service path in the ChromodoUpdater service to execute arbitrary code with elevated privileges.
How do I fix CVE-2016-20088?
To fix CVE-2016-20088, ensure that the ChromodoUpdater service path is properly quoted and consider updating or removing the affected Comodo Chromodo Browser version.
What systems are vulnerable to CVE-2016-20088?
CVE-2016-20088 affects systems running Comodo Chromodo Browser version 52.15.25.664.
Can CVE-2016-20088 be exploited remotely?
CVE-2016-20088 cannot be exploited remotely; it requires local access to the system.