CVE-2019-19620 : What You Need to Know

SecureWorks Red Cloak Windows Agent before 2.0.7.9 allows a local user to bypass telemetry alerts by altering file permissions, affecting process-execution telemetry.

Understanding CVE-2019-19620

This CVE involves a vulnerability in SecureWorks Red Cloak Windows Agent that enables a local user to circumvent telemetry alerts by modifying file permissions.

What is CVE-2019-19620?

In SecureWorks Red Cloak Windows Agent before version 2.0.7.9, a local user can evade the generation of telemetry alerts by removing NT AUTHORITY\SYSTEM permissions from a file. This vulnerability specifically impacts the collection of process-execution telemetry when the SYSTEM user is denied access to the source file.

The Impact of CVE-2019-19620

The vulnerability allows a local user to manipulate file permissions, potentially compromising the integrity of telemetry alerts and hindering the monitoring of process-execution activities.

Technical Details of CVE-2019-19620

This section provides detailed technical insights into the CVE.

Vulnerability Description

The issue arises in SecureWorks Red Cloak Windows Agent before 2.0.7.9, where a local user can bypass telemetry alerts by altering file permissions, specifically affecting process-execution telemetry.

Affected Systems and Versions

SecureWorks Red Cloak Windows Agent before version 2.0.7.9

Exploitation Mechanism

A local user modifies file permissions, particularly removing NT AUTHORITY\SYSTEM permissions from a file, to evade telemetry alerts.

Mitigation and Prevention

Protecting systems from CVE-2019-19620 is crucial to maintaining security.

Immediate Steps to Take

Update SecureWorks Red Cloak Windows Agent to version 2.0.7.9 or later.
Monitor file permissions and access controls to detect unauthorized changes.

Long-Term Security Practices

Implement the principle of least privilege to restrict unnecessary access.
Conduct regular security audits to identify and address vulnerabilities promptly.

Patching and Updates

Apply patches and updates provided by SecureWorks to address the vulnerability and enhance system security.