CVE-2022-1316 (Other, published 2022-04-11T20:15Z)
Description: value: Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation


Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/zerotier/zerotierone
Files changed:
debian/changelog
ext/installfiles/mac/ZeroTier One.pkgproj	
ext/installfiles/windows/ZeroTier One.aip	
version.h
zerotier-one.spec
Commit message: 1.8.8 bump


Vulnerable code:
				<string>1.8.7</string>
    <ROW Property="ProductCode" Value="1033:{002609B2-C32C-481A-B17F-B7ED428427AC} " Type="16"/>
    <ROW Property="ProductVersion" Value="1.8.7"/>
    <ROW Directory="APPDIR" Directory_Parent="TARGETDIR" DefaultDir="APPDIR:." IsPseudoRoot="1" DirectoryOptions="3"/>
    <ROW Directory="One_Dir" Directory_Parent="ZeroTier_Dir" DefaultDir="One"/>
    <ROW Directory="ZeroTier_Dir" Directory_Parent="CommonAppDataFolder" DefaultDir="ZeroTier"/>
    <ROW Directory="i686_Dir" Directory_Parent="APPDIR" DefaultDir=".:i686" DirectoryOptions="3"/>
    <ROW Directory="networks.d_Dir" Directory_Parent="One_Dir" DefaultDir="networks.d"/>
    <ROW Directory="regid.201001.com.zerotier_Dir" Directory_Parent="CommonAppDataFolder" DefaultDir="REGID2~1.ZER|regid.2010-01.com.zerotier"/>
    <ROW Directory="tapwindows_Dir" Directory_Parent="One_Dir" DefaultDir="TAP-WI~1|tap-windows"/>
    <ROW Directory="x64_Dir" Directory_Parent="tapwindows_Dir" DefaultDir="x64"/>
    <ROW Directory="x86_Dir" Directory_Parent="tapwindows_Dir" DefaultDir="x86"/>
    <ROW Component="AI_CustomARPName" ComponentId="{AE9B64A8-133E-4205-A700-6962B9FD02EB}" Directory_="APPDIR" Attributes="4" KeyPath="DisplayName" Options="1"/>
    <ROW Action="AI_ResolveKnownFolders" Sequence="52"/>
    <ROW Action="AI_EnableDebugLog" Sequence="51"/>
    <ROW Action="AI_ResolveKnownFolders" Sequence="53"/>
    <ROW Action="AI_DpiContentScale" Sequence="52"/>
    <ROW Action="AI_EnableDebugLog" Sequence="51"/>
    <ROW XmlElement="swidbuild" ParentElement="swidnumeric" Name="swid:build" Condition="1" Order="2" Flags="14" Text="7" UpdateIndexInParent="0"/>
#define ZEROTIER_ONE_VERSION_REVISION 7
Version:        1.8.7

Fixed code:
zerotier-one (1.8.8) unstable; urgency=medium

  * See RELEASE-NOTES.md for release notes.

 -- Adam Ierymenko <adam.ierymenko@zerotier.com>  Mon, 11 Apr 2022 01:00:00 -0700

				<string>1.8.8</string>
    <ROW Property="ProductCode" Value="1033:{C904F29F-944E-4322-A6A0-B52F7AC3E205} " Type="16"/>
    <ROW Property="ProductVersion" Value="1.8.8"/>
    <ROW Directory="APPDIR" Directory_Parent="TARGETDIR" DefaultDir="APPDIR:." IsPseudoRoot="1" DirectoryOptions="15"/>
    <ROW Directory="One_Dir" Directory_Parent="ZeroTier_Dir" DefaultDir="One" DirectoryOptions="12"/>
    <ROW Directory="ZeroTier_Dir" Directory_Parent="CommonAppDataFolder" DefaultDir="ZeroTier" DirectoryOptions="12"/>
    <ROW Directory="i686_Dir" Directory_Parent="APPDIR" DefaultDir=".:i686" DirectoryOptions="15"/>
    <ROW Directory="networks.d_Dir" Directory_Parent="One_Dir" DefaultDir="networks.d" DirectoryOptions="12"/>
    <ROW Directory="regid.201001.com.zerotier_Dir" Directory_Parent="CommonAppDataFolder" DefaultDir="REGID2~1.ZER|regid.2010-01.com.zerotier" DirectoryOptions="12"/>
    <ROW Directory="tapwindows_Dir" Directory_Parent="One_Dir" DefaultDir="TAP-WI~1|tap-windows" DirectoryOptions="12"/>
    <ROW Directory="x64_Dir" Directory_Parent="tapwindows_Dir" DefaultDir="x64" DirectoryOptions="12"/>
    <ROW Directory="x86_Dir" Directory_Parent="tapwindows_Dir" DefaultDir="x86" DirectoryOptions="12"/>
    <ROW Component="AI_CustomARPName" ComponentId="{3AD372B5-B885-444C-9AC7-D2FCCBB03811}" Directory_="APPDIR" Attributes="4" KeyPath="DisplayName" Options="1"/>
    <ROW Component="One" ComponentId="{41AB11E7-066E-414A-96F8-F051D3D3B353}" Directory_="One_Dir" Attributes="0"/>
    <ROW Component="ZeroTier" ComponentId="{8864F744-9BDF-4891-88A1-6D23D76BCCB1}" Directory_="ZeroTier_Dir" Attributes="0"/>
    <ROW Component="i686_1" ComponentId="{60156BDC-31D7-47EE-A307-B62129607DD5}" Directory_="i686_Dir" Attributes="0"/>
    <ROW Component="tapwindows" ComponentId="{3E9CBCCE-EC9D-4802-B8FD-DADB4CC532A2}" Directory_="tapwindows_Dir" Attributes="0"/>
    <ROW Component="x64" ComponentId="{4DD1F90B-53F1-4390-BDF1-E6D9B39B8D80}" Directory_="x64_Dir" Attributes="0"/>
    <ROW Component="x86" ComponentId="{8E83C577-3C22-49B7-82A8-369BE1F19224}" Directory_="x86_Dir" Attributes="0"/>
    <ROW Directory_="ZeroTier_Dir" Component_="ZeroTier" ManualDelete="true"/>
    <ROW Directory_="One_Dir" Component_="One" ManualDelete="false"/>
    <ROW Directory_="tapwindows_Dir" Component_="tapwindows" ManualDelete="false"/>
    <ROW Directory_="x64_Dir" Component_="x64" ManualDelete="false"/>
    <ROW Directory_="x86_Dir" Component_="x86" ManualDelete="false"/>
    <ROW Directory_="i686_Dir" Component_="i686_1" ManualDelete="false"/>
    <ROW Action="AI_ResolveLocalizedCredentials" Type="1" Source="aicustact.dll" Target="GetLocalizedCredentials"/>
    <ROW Feature_="ZeroTierOne" Component_="ZeroTier"/>
    <ROW Feature_="ZeroTierOne" Component_="One"/>
    <ROW Feature_="ZeroTierOne" Component_="tapwindows"/>
    <ROW Feature_="ZeroTierOne" Component_="x64"/>
    <ROW Feature_="ZeroTierOne" Component_="x86"/>
    <ROW Feature_="ZeroTierOne" Component_="i686_1"/>
    <ROW Action="AI_ResolveKnownFolders" Sequence="53"/>
    <ROW Action="AI_EnableDebugLog" Sequence="52"/>
    <ROW Action="AI_DETECT_MODERNWIN" Condition="(VersionNT &gt;= 603)" Sequence="54" MsiKey="AI_DETECT_MODERNWIN"/>
    <ROW Action="AI_ResolveLocalizedCredentials" Sequence="51"/>
    <ROW Action="AI_ResolveKnownFolders" Sequence="54"/>
    <ROW Action="AI_DpiContentScale" Sequence="53"/>
    <ROW Action="AI_EnableDebugLog" Sequence="52"/>
    <ROW Action="AI_ResolveLocalizedCredentials" Sequence="51"/>
  <COMPONENT cid="caphyon.advinst.msicomp.MsiLockPermComponent">
    <ROW LockObject="ZeroTier_Dir" Table="CreateFolder" User="[GRP_EVERYONE]" Permission="1179817" Flags="0"/>
    <ROW LockObject="ZeroTier_Dir" Table="CreateFolder" User="[GRP_ADMINISTRATORS]" Permission="1245631" Flags="0"/>
    <ROW LockObject="One_Dir" Table="CreateFolder" User="[GRP_ADMINISTRATORS]" Permission="1245631" Flags="0"/>
    <ROW LockObject="One_Dir" Table="CreateFolder" User="[GRP_EVERYONE]" Permission="1179817" Flags="0"/>
    <ROW LockObject="networks.d_Dir" Table="CreateFolder" User="[GRP_ADMINISTRATORS]" Permission="1245631" Flags="0"/>
    <ROW LockObject="networks.d_Dir" Table="CreateFolder" User="[GRP_EVERYONE]" Permission="1179817" Flags="0"/>
    <ROW LockObject="tapwindows_Dir" Table="CreateFolder" User="[GRP_EVERYONE]" Permission="1179817" Flags="0"/>
    <ROW LockObject="tapwindows_Dir" Table="CreateFolder" User="[GRP_ADMINISTRATORS]" Permission="1245631" Flags="0"/>
    <ROW LockObject="x64_Dir" Table="CreateFolder" User="[GRP_ADMINISTRATORS]" Permission="1245631" Flags="0"/>
    <ROW LockObject="x64_Dir" Table="CreateFolder" User="[GRP_EVERYONE]" Permission="1179817" Flags="0"/>
    <ROW LockObject="x86_Dir" Table="CreateFolder" User="[GRP_ADMINISTRATORS]" Permission="1245631" Flags="0"/>
    <ROW LockObject="x86_Dir" Table="CreateFolder" User="[GRP_EVERYONE]" Permission="1179817" Flags="0"/>
    <ROW LockObject="regid.201001.com.zerotier_Dir" Table="CreateFolder" User="[GRP_EVERYONE]" Permission="1179817" Flags="0"/>
    <ROW LockObject="APPDIR" Table="CreateFolder" User="[GRP_EVERYONE]" Permission="1179817" Flags="0"/>
    <ROW LockObject="i686_Dir" Table="CreateFolder" User="[GRP_EVERYONE]" Permission="1179817" Flags="0"/>
  </COMPONENT>
    <ROW XmlElement="swidbuild" ParentElement="swidnumeric" Name="swid:build" Condition="1" Order="2" Flags="14" Text="8" UpdateIndexInParent="0"/>
#define ZEROTIER_ONE_VERSION_REVISION 8
Version:        1.8.8
* Fri Apr 11 2022 Adam Ierymenko <adam.ierymenko@zerotier.com> - 1.8.8
- see https://github.com/zerotier/ZeroTierOne for release notes