CVE-2022-41604: High severity Checkpoint ZoneAlarm vulnerability
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows creation of a junction directory. This can be leveraged to perform an arbitrary file move as NT AUTHORITY\SYSTEM.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-41604.
What is the severity level of CVE-2022-41604?
CVE-2022-41604 has a severity level of 8.8 (high).
What software version is affected by CVE-2022-41604?
The software version affected by CVE-2022-41604 is Check Point ZoneAlarm Extreme Security before 15.8.211.19229.
How can a local user escalate privileges with CVE-2022-41604?
A local user can escalate privileges with CVE-2022-41604 by exploiting weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory and bypassing the self-protection driver to create a junction directory.
Is there a fix available for CVE-2022-41604?
Yes, the fix for CVE-2022-41604 is to update Check Point ZoneAlarm Extreme Security to version 15.8.211.19229 or later.