CVE-2019-5629
First published: Sat Jul 13 2019(Updated: )
Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4.
Credit: cve@rapid7.con
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rapid7 Insight Agent | <=2.6.3 |
Remedy
This issue affects Insight Agent instances at version 2.6.4 and older. Insight Agent will normally update automatically. Otherwise, if your Insight Agent instances are not running 2.6.5 or higher, ensure that you update all instances to 2.6.5 (or later if available).
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html
- http://seclists.org/fulldisclosure/2019/Jun/13
- https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/
- https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529
- https://seclists.org/bugtraq/2019/Jun/0
Frequently Asked Questions
What is CVE-2019-5629?
CVE-2019-5629 is a vulnerability in Rapid7 Insight Agent version 2.6.3 and prior that allows for local privilege escalation.
What is the severity of CVE-2019-5629?
The severity of CVE-2019-5629 is high with a CVSS score of 7.8.
How does CVE-2019-5629 work?
CVE-2019-5629 allows an attacker to escalate their privileges locally by exploiting an uncontrolled DLL search path in Rapid7 Insight Agent.
Is there a fix for CVE-2019-5629?
Yes, upgrading Rapid7 Insight Agent to a version higher than 2.6.3 will fix the vulnerability.
Where can I find more information about CVE-2019-5629?
You can find more information about CVE-2019-5629 at the following references: [link1](http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html), [link2](http://seclists.org/fulldisclosure/2019/Jun/13), [link3](https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/remedy
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- vendor/rapid7
- canonical/rapid7 insight agent
- version/rapid7 insight agent/2.6.3