CVE-2019-11644 : Exploit Details and Defense Strategies

In previous versions of F-Secure SAFE for Windows, F-Secure Internet Security, F-Secure Anti-Virus, F-Secure Client Security Standard and Premium, F-Secure PSB Workstation Security, and F-Secure Computer Protection Standard and Premium, a vulnerability in the F-Secure installer allows a local user to gain higher privileges using a DLL hijacking technique.

Understanding CVE-2019-11644

This CVE entry describes a privilege escalation vulnerability in various F-Secure products due to a flaw in the installer process.

What is CVE-2019-11644?

The vulnerability in the F-Secure installer in multiple F-Secure products allows a local user to escalate their privileges through a DLL hijacking attack during the installation process.

The Impact of CVE-2019-11644

The vulnerability enables a non-administrative user to execute malicious code with elevated privileges, potentially leading to unauthorized access and control of the affected system.

Technical Details of CVE-2019-11644

The technical aspects of the vulnerability are as follows:

Vulnerability Description

The F-Secure installer in specific product versions is susceptible to DLL hijacking, allowing for privilege escalation.

Affected Systems and Versions

F-Secure SAFE for Windows before version 17.6
F-Secure Internet Security before version 17.6
F-Secure Anti-Virus before version 17.6
F-Secure Client Security Standard and Premium before version 14.10
F-Secure PSB Workstation Security before version 12.01
F-Secure Computer Protection Standard and Premium before version 19.3

Exploitation Mechanism

During installation, the installer creates a file named rm.exe in the C:\Windows\Temp directory and executes it, leading to DLL loading from the current directory, which can be exploited by an attacker.

Mitigation and Prevention

To address CVE-2019-11644, consider the following steps:

Immediate Steps to Take

Update the affected F-Secure products to the latest patched versions.
Restrict write permissions to critical directories to prevent unauthorized DLL loading.

Long-Term Security Practices

Implement the principle of least privilege to limit user permissions.
Regularly monitor and audit file system changes to detect unauthorized activities.

Patching and Updates

Apply security patches provided by F-Secure to fix the vulnerability and enhance system security.