CVE-2020-13162
First published: Tue Jun 16 2020(Updated: )
A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM) allows unprivileged users to run a Microsoft Installer executable with elevated privileges.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pulsesecure Pulse Secure Desktop Client | =5.3-r1.0 | |
| Pulsesecure Pulse Secure Desktop Client | =5.3-r1.1 | |
| Pulsesecure Pulse Secure Desktop Client | =5.3-r2.0 | |
| Pulsesecure Pulse Secure Desktop Client | =5.3-r3.0 | |
| Pulsesecure Pulse Secure Desktop Client | =5.3-r4.1 | |
| Pulsesecure Pulse Secure Desktop Client | =5.3-r4.2 | |
| Pulsesecure Pulse Secure Desktop Client | =5.3-r5.0 | |
| Pulsesecure Pulse Secure Desktop Client | =5.3-r5.2 | |
| Pulsesecure Pulse Secure Desktop Client | =5.3-r6.0 | |
| Pulsesecure Pulse Secure Desktop Client | =5.3-r7.0 | |
| Pulsesecure Pulse Secure Desktop Client | =9.0-r1.0 | |
| Pulsesecure Pulse Secure Desktop Client | =9.0-r2 | |
| Pulsesecure Pulse Secure Desktop Client | =9.0-r2.1 | |
| Pulsesecure Pulse Secure Desktop Client | =9.0-r3 | |
| Pulsesecure Pulse Secure Desktop Client | =9.0-r3.2 | |
| Pulsesecure Pulse Secure Desktop Client | =9.0-r4 | |
| Pulsesecure Pulse Secure Desktop Client | =9.0-r4.0 | |
| Pulsesecure Pulse Secure Desktop Client | =9.0-r5.0 | |
| Pulsesecure Pulse Secure Desktop Client | =9.0-r6.0 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r1.0 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r2.0 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r3.0 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r3.1 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r4.0 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r4.1 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r4.2 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r5.0 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r6.0 | |
| Pulsesecure Pulse Secure Desktop Client | =9.1-r7.0 | |
| Pulsesecure Pulse Secure Installer Service | =8.3 | |
| Pulsesecure Pulse Secure Installer Service | =9.1 | |
| Pulsesecure Pulse Secure Installer Service | =9.1-r5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/158117/Pulse-Secure-Client-For-Windows-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/159065/Pulse-Secure-Windows-Client-Privilege-Escalation.html
- http://seclists.org/fulldisclosure/2020/Jun/25
- http://seclists.org/fulldisclosure/2020/Sep/15
- https://kb.pulsesecure.net/?atype=sa
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44503
- https://twitter.com/gsepcali/status/1262551597990711296
- https://twitter.com/gsepcali/status/1272927080909623297
- https://twitter.com/sepcali/status/1262551597990711296
- https://www.redtimmy.com/privilege-escalation/pulse-secure-client-for-windows-9-1-6-toctou-privilege-escalation-cve-2020-13162/
Frequently Asked Questions
What is CVE-2020-13162?
CVE-2020-13162 is a time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows.
What is the severity of CVE-2020-13162?
The severity of CVE-2020-13162 is high, with a severity value of 7.
How does CVE-2020-13162 affect Pulse Secure Desktop Client?
CVE-2020-13162 affects Pulse Secure Desktop Client versions 5.3 R1.0 to 5.3 R70 for Windows.
How does CVE-2020-13162 allow privilege escalation?
CVE-2020-13162 allows unprivileged users to run a Microsoft Installer executable with elevated privileges.
Are there any known fixes for CVE-2020-13162?
Yes, the fix for CVE-2020-13162 is to upgrade to Pulse Secure Client version 9.1.6 or later.
- collector/nvd-index
- agent/author
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/pulsesecure
- canonical/pulsesecure pulse secure desktop client
- version/pulsesecure pulse secure desktop client/5.3-r1.0
- version/pulsesecure pulse secure desktop client/5.3-r1.1
- version/pulsesecure pulse secure desktop client/5.3-r2.0
- version/pulsesecure pulse secure desktop client/5.3-r3.0
- version/pulsesecure pulse secure desktop client/5.3-r4.1
- version/pulsesecure pulse secure desktop client/5.3-r4.2
- version/pulsesecure pulse secure desktop client/5.3-r5.0
- version/pulsesecure pulse secure desktop client/5.3-r5.2
- version/pulsesecure pulse secure desktop client/5.3-r6.0
- version/pulsesecure pulse secure desktop client/5.3-r7.0
- version/pulsesecure pulse secure desktop client/9.0-r1.0
- version/pulsesecure pulse secure desktop client/9.0-r2
- version/pulsesecure pulse secure desktop client/9.0-r2.1
- version/pulsesecure pulse secure desktop client/9.0-r3
- version/pulsesecure pulse secure desktop client/9.0-r3.2
- version/pulsesecure pulse secure desktop client/9.0-r4
- version/pulsesecure pulse secure desktop client/9.0-r4.0
- version/pulsesecure pulse secure desktop client/9.0-r5.0
- version/pulsesecure pulse secure desktop client/9.0-r6.0
- version/pulsesecure pulse secure desktop client/9.1-r1.0
- version/pulsesecure pulse secure desktop client/9.1-r2.0
- version/pulsesecure pulse secure desktop client/9.1-r3.0
- version/pulsesecure pulse secure desktop client/9.1-r3.1
- version/pulsesecure pulse secure desktop client/9.1-r4.0
- version/pulsesecure pulse secure desktop client/9.1-r4.1
- version/pulsesecure pulse secure desktop client/9.1-r4.2
- version/pulsesecure pulse secure desktop client/9.1-r5.0
- version/pulsesecure pulse secure desktop client/9.1-r6.0
- version/pulsesecure pulse secure desktop client/9.1-r7.0
- canonical/pulsesecure pulse secure installer service
- version/pulsesecure pulse secure installer service/8.3
- version/pulsesecure pulse secure installer service/9.1
- version/pulsesecure pulse secure installer service/9.1-r5.0