Vulnerability Description
In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10, F-Secure PSB Workstation Security before 12.01, and F-Secure Computer Protection Standard and Premium before 19.3, a local user can escalate their privileges through a DLL hijacking attack against the installer. The installer writes the file rm.exe to C:\Windows\Temp and then executes it. The rm.exe process then attempts to load several DLLs from its current directory. Non-admin users are able to write to this folder, so an attacker can create a malicious C:\Windows\Temp\OLEACC.dll file. When an admin runs the installer, rm.exe will execute the attacker's DLL in an elevated security context.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| F-Secure | Client Security | < 14.10 |
| F-Secure | Computer Protection | < 19.3 |
| F-Secure | Internet Security | < 17.6 |
| F-Secure | Psb Workstation Security | < 12.01 |
| F-Secure | Safe | < 17.6 |
Related Weaknesses (CWE)
References
- https://www.f-secure.com/en/web/labs_global/fsc-2019-2Vendor Advisory
- https://www.f-secure.com/en/web/labs_global/fsc-2019-2Vendor Advisory
FAQ
What is CVE-2019-11644?
CVE-2019-11644 is a vulnerability with a CVSS score of 7.8 (HIGH). In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10,...
How severe is CVE-2019-11644?
CVE-2019-11644 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11644?
Check the references section above for vendor advisories and patch information. Affected products include: F-Secure Client Security, F-Secure Computer Protection, F-Secure Internet Security, F-Secure Psb Workstation Security, F-Secure Safe.