CVE-2020-13173 : Security Advisory and Response

Initialization of the pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows versions 19.11.1 and earlier creates an insecure named pipe, allowing attackers to intercept sensitive information or potentially elevate privileges.

Understanding CVE-2020-13173

This CVE involves information disclosure and privilege escalation in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows.

What is CVE-2020-13173?

CVE-2020-13173 refers to the insecure creation of a named pipe during the initialization of pcoip_credential_provider in specific versions of Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows. This vulnerability enables attackers to intercept sensitive data or potentially escalate their privileges.

The Impact of CVE-2020-13173

The vulnerability allows attackers to:

Intercept sensitive information
Potentially elevate privileges

Technical Details of CVE-2020-13173

This section provides detailed technical information about the CVE.

Vulnerability Description

The vulnerability arises from the insecure creation of a named pipe during the initialization of pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows versions 19.11.1 and earlier.

Affected Systems and Versions

Affected Products: PCoIP Standard Agent for Windows, PCoIP Graphics Agent for Windows
Vulnerable Versions: 19.11.1 and earlier

Exploitation Mechanism

Attackers can exploit this vulnerability by pre-installing an application that acquires the insecure named pipe, enabling them to intercept sensitive information or potentially elevate their privileges.

Mitigation and Prevention

Protecting systems from CVE-2020-13173 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update affected Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows to versions beyond 19.11.1.
Monitor for any unauthorized access or unusual activities on the named pipe.

Long-Term Security Practices

Implement the principle of least privilege to restrict access rights for users and applications.
Regularly review and update security configurations to mitigate similar vulnerabilities.

Patching and Updates

Apply patches and updates provided by Teradici to address the vulnerability and enhance system security.