Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-3567

In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with k

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
facebook

Description

In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known 'safe' permissions. Under those circumstances osquery will load said malicious executable with SYSTEM permissions. The solution is to migrate installations to the 'Program Files' directory on Windows which restricts unprivileged write access. This issue affects osquery prior to v3.4.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Facebook osquery

  • 3.4.0affected
  • unspecified to < 3.4.0affected

References