CVE-2018-5349: High severity Heimdalsecurity Heimdal vulnerability
A vulnerability has been found in Heimdal PRO v2.2.190, but it is most likely also present in Heimdal FREE and Heimdal CORP. Faulty permissions on the directory "C:\ProgramData\Heimdal Security\Heimdal Agent" allow BUILTIN\Users to write new files to the directory. On startup, the process Heimdal.MonitorServices.exe running as SYSTEM will attempt to load version.dll from this directory. Placing a malicious version.dll in this directory will result in privilege escalation. NOTE: any affected Heimdal products are completely unrelated to the Heimdal vendor of a Kerberos 5 product on the h5l.org web site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update NTFS permissions on the directory "C:\ProgramData\Heimdal Security\Heimdal Agent" to prevent "BUILTIN\Users" from writing new files. Ensure only trusted administrative/SYSTEM accounts have write access so that a malicious "version.dll" cannot be placed there.
Heimdal PRO v2.2.190 (Heimdal Agent) Directory permissions for C:\ProgramData\Heimdal Security\Heimdal Agent (write access) = Remove write permission for BUILTIN\Users
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5349?
The severity of CVE-2018-5349 is considered to be medium due to improper permissions that could allow unauthorized file modifications.
How do I fix CVE-2018-5349?
To fix CVE-2018-5349, review and adjust the permissions on the directory 'C:\ProgramData\Heimdal Security\Heimdal Agent' to prevent unauthorized access.
What types of software are affected by CVE-2018-5349?
CVE-2018-5349 affects Heimdal PRO version 2.2.190 and is likely also present in Heimdal FREE and Heimdal CORP.
What impact does CVE-2018-5349 have on systems?
CVE-2018-5349 could allow malicious users to write files in a sensitive directory, potentially leading to further exploits.
How can I identify if my system is vulnerable to CVE-2018-5349?
To identify if your system is vulnerable to CVE-2018-5349, check the installed version of Heimdal and the permissions set on the 'C:\ProgramData\Heimdal Security\Heimdal Agent' directory.