[ad_1]
Cybersecurity researchers have disclosed a number of vulnerabilities in a third-party driver software program developed by Eltima which were “unwittingly inherited” by cloud desktop options like Amazon Workspaces, Accops, and NoMachine and will present attackers a path to carry out an array of malicious actions.
“These vulnerabilities enable attackers to escalate privileges enabling them to disable safety merchandise, overwrite system elements, corrupt the working system, or carry out malicious operations unimpeded,” SentinelOne researchers mentioned in a report shared with The Hacker Information.
The issues have since been addressed in Amazon Nimble Studio AMI, Amazon NICE DCV, Amazon WorkSpaces, Amazon AppStream, NoMachine, Accops HyWorks, Accops HyWorks DVM Instruments, Eltima USB Community Gate, Amzetta zPortal Home windows zClient, Amzetta zPortal DVM Instruments, FlexiHub, and Donglify.
At its core, the problems reside in a product developed by Eltima that provides “USB over Ethernet” capabilities, and allows desktop virtualization companies like Amazon WorkSpaces to redirect related USB units equivalent to webcams to their distant desktop.
Particularly, the vulnerabilities will be traced again to 2 drivers which can be accountable for USB redirection — “wspvuhub.sys” and “wspusbfilter.sys” — resulting in a buffer overflow state of affairs that would consequence within the execution of arbitrary code with kernel-mode privileges.
 |
| BSoD Proof Of Idea |
“An attacker with entry to a corporation’s community may additionally acquire entry to execute code on unpatched programs and use this vulnerability to achieve native elevation of privilege,” the cybersecurity agency famous. “Attackers can then leverage different methods to pivot to the broader community, like lateral motion.”
The invention marks the fourth set of safety vulnerabilities affecting software program drivers which were uncovered by SentinelOne because the begin of the 12 months.
Earlier this Might, the Mountain View-based firm disclosed a variety of privilege escalation vulnerabilities in Dell’s firmware replace driver named “dbutil_2_3.sys” that went undisclosed for greater than 12 years. Then in July, it additionally made public a high-severity buffer overflow flaw impacting “ssport.sys” and utilized in HP, Xerox, and Samsung printers that have been discovered to have remained undetected since 2005.
And in September, SentinelOne made public a high-severity flaw within the HP OMEN driver software program “HpPortIox64.sys” that would enable risk actors to raise privileges to kernel mode with out requiring administrator permissions, permitting them to disable safety merchandise, overwrite system elements, and even corrupt the working system.
[ad_2]
