CVE-2024-50590: Local Privilege Escalation via Weak Service Binary Permissions
Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is writable for all users. In addition, the Elefant installer registers two Firebird database services which are running as “NT AUTHORITY\SYSTEM”.
Path: C:\Elefant1\Firebird2\bin\fbserver.exe
Path: C:\Elefant1\Firebird2\bin\fbguard.exe
Both service binaries are user writable. This means that a local attacker can rename one of the service binaries, replace the service executable with a new executable, and then restart the system. Once the system has rebooted, the new service binary is executed as "NT AUTHORITY\SYSTEM".
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50590?
CVE-2024-50590 has a high severity due to its potential for local privilege escalation.
How do I fix CVE-2024-50590?
To mitigate CVE-2024-50590, ensure that the file permissions for Elefant service binaries are properly set to prevent unauthorized access.
Who is affected by CVE-2024-50590?
CVE-2024-50590 affects users of the Elefant software and Firebird Database that have local access to the system.
What kind of attack does CVE-2024-50590 involve?
CVE-2024-50590 involves an attack where local users can escalate their privileges via overwriting service binaries with weak permissions.
What software versions are affected by CVE-2024-50590?
CVE-2024-50590 primarily affects the Elefant software and Firebird Database installations regardless of version.