CVE-2024-50592: Local Privilege Escalation via Race Condition
An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using the repair function, the service queries the server for a list of files and their hashes. In addition, instructions to execute binaries to finalize the repair process are included. The executables are executed as "NT AUTHORITY\SYSTEM" after they are copied over to the user writable installation folder (C:\Elefant1). This means that a user can overwrite either "PostESUUpdate.exe" or "UpdateOpenJava.exe" in the time frame after the copy and before the execution of the final repair step. The overwritten executable is then executed as "NT AUTHORITY\SYSTEM".
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50592?
CVE-2024-50592 is considered a high-severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2024-50592?
To mitigate CVE-2024-50592, it is recommended to patch the Elefant Update Service to the latest version provided by the vendor.
Who is affected by CVE-2024-50592?
CVE-2024-50592 affects users of the Elefant Update Service on Windows systems where an attacker has local access.
What type of attack is CVE-2024-50592 associated with?
CVE-2024-50592 is associated with a local privilege escalation attack that exploits a race condition.
Can CVE-2024-50592 be exploited remotely?
No, CVE-2024-50592 requires local access to the affected system to be exploited.