CVE-2024-1244: Remote code execution and local privilege escalation due to UNC access and NetNTLMv2 hash theft
Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession of the agent's key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM via AD CS certificate forging and other similar attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1244?
The severity of CVE-2024-1244 is categorized as high due to the potential for remote code execution when exploited.
How do I fix CVE-2024-1244?
To fix CVE-2024-1244, upgrade the OSSEC HIDS agent for Windows to version 3.8.0 or later.
What systems are affected by CVE-2024-1244?
CVE-2024-1244 affects OSSEC HIDS agent for Windows versions prior to 3.8.0.
What risk does CVE-2024-1244 pose to users?
CVE-2024-1244 poses a risk of machine account leakage and potential exploitation by attackers controlling the OSSEC server.
How can an attacker exploit CVE-2024-1244?
An attacker can exploit CVE-2024-1244 by configuring the OSSEC agent to connect to a malicious UNC path.