CWE Code: 732
Vulnerability Type: privilege_escalation
CVSS Score: 4.6
CWE Name:  Incorrect Permission Assignment for Critical Resource
Summary: a vulnerability has been found in heimdal pro v2.2.190, but it is most likely also present in heimdal free and heimdal corp. faulty permissions on the directory "c:\programdata\heimdal security\heimdal agent" allow builtin\users to write new files to the directory. on startup, the process heimdal.monitorservices.exe running as system will attempt to load version.dll from this directory. placing a malicious version.dll in this directory will result in privilege escalation. note: any affected heimdal products are completely unrelated to the heimdal vendor of a kerberos 5 product on the h5l.org web site.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-03-22
Last Modified Date: 2019-10-03