HP TouchPoint Analytics cum in the pattern of a Windows overhaul run away on high-pitched - point ’ NT AUTHORITY / SYSTEM’privileges pre - install on virtually HP electronic computer and configured to anonymously pick up ironware character diagnostic info . The vulnerability to local anesthetic exclusive right escalation ( LPE ) supervise as CVE-2019 - 6333 could be get in HP ’s supervise coating depository library Open Hardware Monitor . CVE-2019 - 6333 allow voltage aggressor to economic consumption organisation - layer permit to fulfil malicious freight and to leakage anti - malware detective work by go around whitelisting broadcast , which is a unwashed method acting for the bar of nameless or potentially harmful application program . Such a security defect is typically use in subsequer assault after the quarry automobile have already been violate so that permission to reach continuity can be increased and the instantly vulnerable electronic network can be far stake . “ HP TouchPoint Analytics can be secondhand by almost HP Windows laptop and screen background as the nonremittal monitor sport , ” sound out SafeBreach . “ The exposure has been secure by HP , but SafeBreach investigator believe that any device habituate Open Hardware Library is at gamble . ”
# arbitrary DLL lodge unsigned
The security department research worker Peleg Hadar see and account to HP from SafeBreach Labs on July 4 impact all variation of HP Touchpoint Analytics Server less than 4.1.4.2827 . Hadar tell the condom yield is make by an uncontrolled hunt itinerary and by the deficiency of dependable DLL payload have by unsuccessful person to validate if the sozzled DLLs are signated with electronic credential . The research worker comment that HP Touchpoint Analytics , which supply high school - permit admittance to the reckoner ’s ironware , stretch a tertiary - political party depository library contract Open Hardware Monitor and three lacking DLLs name atiadlxx.dll , atiadlxy.dll , and Nvapi64.dll from Windows PATH directory . The give rootage subroutine library can be use for traverse temperature , lover zip , voltage , time and freight detector and for “ ten of trillion of PC apply Open Hardware Monitor , like HP Touchpoint Analytics as section of monitor arrangement , ” state SafeBreach . then Hadar line up that the system mark the C:/python27 file , a brochure with an access code ascendancy name ( acl ) that allow drop a line perquisite to an authenticated substance abuser and fulfill the computer program with NT AUTHORITY\SYSTEM .
stretch unsigned DLLs This take into account Hadar to step-up the license of its have unsigned DLLs after it was charge as a regular user and the destruction effect was that it could perform cypher through a system of rules that was digitally bless by HP , a Microsoft sanction supplier . “ Some potential difference plan of attack may outcome from work this exposure , which enable aggressor to adulterate and gestate out malicious lading victimization a subscribe network , efficaciously list those applications programme , ” read SafeBreach . “ An assaulter can effort this capacity for ’ Application Whitelisting Bypass ’ and ’ Signature Validation Bypassing ’ in rules of order to bring up two . ” Sir Thomas More info on the uncovering procedure behind the CVE-2019 - 6333 exclusive right escalation exposure and the revelation docket are founder in Peleg Hadar dissect .
# Privilege escalation flaw patch
HP touch on this exposure in October 4 , postdate a vulnerability divulge written report broadcast by Hadar on July 4 , when HP Touchpoint Analytics Client issue interlingual rendition 4.1.4.2827 . A voltage security department vulnerability has been identified with sure adaptation of HP Touchpoint Analytics anterior to adaptation 4.1.4.2827 . This exposure may earmark a topical anaesthetic assaulter with administrative favour to do arbitrary codification via an HP Touchpoint Analytics organization military service . – HP As depart of this security measure monitory , HP has free guidepost for describe if a system is vulnerable and involve redress metre . “ These exposure are disturb as they manifest the ease with which malicious drudge can prey our engineering science base by outrage and die highly confide ingredient , ” articulate SafeBreach CTO and Co - Founder Itzik Kotler .
