Dropbox Zero-Day Vulnerability Gets Temporary Fix

guest · Dec 21, 2019

Dropbox Zero-Day Vulnerability Gets Temporary Fix
December 21, 2019
https://www.bleepingcomputer.com/news/security/dropbox-zero-day-vulnerability-gets-temporary-fix/

A zero-day vulnerability exists in Dropbox for Windows that allows attackers to gain permissions reserved to SYSTEM, the most privileged account on the operating system.
The unpatched security flaw affects standard Dropbox installations. It relates to the updater that runs as a service and is responsible for keeping the application up to date.

They say that they informed Dropbox of the issue on September 18 and allowed a 90-day period before making a public disclosure. The company responded saying that the problem was known and a fix would become available before the end of October.
Technical details, no PoC
In a blog post this week, Decoder offers details for leveraging the vulnerability to elevate privileges on an already compromised host. The exploit code is not provided, since the purpose of the disclosure is to “share knowledge, not tools.”
Click to expand...

Until Dropbox rolls out a better version, an interim solution can be applied via 0Patch, a platform that delivers micropatches for known issues before a temporary fix becomes available.
Click to expand...

From dropbox(updater) to NT AUTHORITY\SYSTEM

POSSIBLE COUNTERMEASURES
Waiting for the new (hopefully patched) release, meantime you could remove the “Create files” / write data” and the “Create folders /append data” permissions for “Users” on the Log folder and you should be fine
Click to expand...

Log in or Sign up

Dropbox Zero-Day Vulnerability Gets Temporary Fix

guest Guest

Log in or Sign up

Dropbox Zero-Day Vulnerability Gets Temporary Fix

guest Guest

Useful Searches