"An attacker can use any of the unpatched vulnerabilities to escalate their privileges to administrator," Demirkapi says. "Local privilege escalation vulnerabilities are used after an attacker gains access to your system," Demirkapi says, "making it far less likely to occur than, for example, a remote code execution vulnerability." This means the average user, Demirkapi says, "probably aren't at significant risk of having this vulnerability exploited against them." Where they would still be at risk while these vulnerabilities remain unpatched is in the case of an attacker who already has a presence on the computer but in a non-admin user role. I contacted Demirkapi to chat about his research and the three unpatched local privilege escalation vulnerabilities in particular. Still, a patch was released on April 1 that the HP Product Security Response Team (PSRT) said fixes "potential escalation of privilege and arbitrary file deletion" with "certain versions of HP Support Assistant." This should automatically update HP Support Assistant software, but the software can also be updated manually by following the resolution instructions in the security bulletin published April 2.ĭemirkapi has an in-depth drill-down in his public disclosure, published April 3, which is worth a read if you want the technical minutiae.Īre you still at risk as an HP Support Assistant user? This was delayed because of the ongoing COVID-19 pandemic. However, he also noted that there were still unpatched vulnerabilities after this date and sent another report to HP on January 6, 2020, and another patch was scheduled for release in March. An update meant to fix the problems was pushed out by HP on December 19, Demirkapi said.
In his vulnerability disclosure, Demirkapi said he first reported his findings to HP on October 5, 2019.
0 kommentar(er)
