CVE-2022-47529

Vulnerability

In RSA NetWitness Platform Endpoint Windows Agents prior to version 12.2, a local user can exploit insecure Win32 memory objects (e.g., event objects) to modify the endpoint agent service configuration. The affected component is LANDeskService.exe (SHA-256 770005f9b2333bf713ec533ef1efd2b65083a5cfb9f8cbb805ccb2eba423cc3d). All versions before 12.2 are vulnerable [1][2].

Exploitation

An attacker with local access (standard user or admin) can open a handle to the Win32 memory objects held by the endpoint agent, modify the access control list (ACL) for those objects with insecure ACLs, and deny access to the Everyone group. This ACL modification allows the attacker to either stop the agent from sending events to the SIEM or make it run user-supplied commands [1]. The exploit does not require elevated privileges when performed by a standard user [2].

Impact

Successful exploitation results in either a denial-of-service (agent disabled) or arbitrary code execution with the privileges of the endpoint agent service. This bypasses the intended tamper-protection features of the agent [1][2].

Mitigation

RSA NetWitness Platform version 12.2 includes a fix for this vulnerability. Users should upgrade to version 12.2 or later to mitigate the issue. No workarounds are documented in the available references [1][2].