CVE-2019-8458 : Security Advisory and Response
Learn about CVE-2019-8458 affecting Check Point Endpoint Security Client for Windows. Find out how an attacker can exploit a DLL loading issue to execute code and potentially terminate the client.
The Check Point Endpoint Security Client for Windows, specifically the version E81.00 and earlier, has a vulnerability that allows an attacker with administrator privileges to execute code within a signed binary, potentially leading to client termination.
Understanding CVE-2019-8458
This CVE involves a DLL loading vulnerability in the Check Point Endpoint Security Client for Windows.
What is CVE-2019-8458?
The vulnerability in the Check Point Endpoint Security Client for Windows, before version E81.00, enables an attacker to execute code within a signed binary by exploiting a DLL loading issue during a UI-initiated update.
The Impact of CVE-2019-8458
- An attacker with admin privileges can execute malicious code within a Check Point signed binary.
- Exploiting this vulnerability may result in the termination of the client software.
Technical Details of CVE-2019-8458
This section provides more technical insights into the CVE.
Vulnerability Description
The Check Point Endpoint Security Client for Windows, with the Anti-Malware blade installed, attempts to load a non-existent DLL during a UI-initiated update, allowing an attacker to gain code execution within a signed binary.
Affected Systems and Versions
- Product: Check Point Endpoint Security Client for Windows, Anti-Malware blade
- Vendor: Check Point
- Versions Affected: Before E81.00
Exploitation Mechanism
The vulnerability is exploited by an attacker with administrator privileges leveraging the DLL loading issue during a UI update.
Mitigation and Prevention
Protect your systems from CVE-2019-8458 with the following steps:
Immediate Steps to Take
- Update the affected software to version E81.00 or later.
- Monitor for any unusual activities on the system.
Long-Term Security Practices
- Implement the principle of least privilege to restrict admin access.
- Regularly review and update security configurations.
Patching and Updates
- Apply security patches and updates promptly to prevent exploitation of known vulnerabilities.