HP Touchpoint Analytics Opens PCs to Code Execution Attack

guest · Oct 10, 2019

HP Touchpoint Analytics Opens PCs to Code Execution Attack
The vulnerability stems from an issue with DLL loading
October 10, 2019
https://threatpost.com/hp-touchpoint-analytics-opens-pcs-to-code-execution-attack/149069/

A security flaw, discovered in an open-source software program that is a key component of HP’s TouchPoint Analytics service, is opening up a wide swath of HP computers to attack. The vulnerability, if exploited by local attackers with administrative privileges, can allow them to execute arbitrary code on victim systems.

HP TouchPoint Analytics is a service that anonymously collects diagnostic information about hardware performance. The service is pre-installed on most HP PCs, meaning the flaw has a wide attack surface, said researchers.

“A number of potential attacks could result from exploiting this vulnerability giving attackers the ability to load and execute malicious payloads using a signed service, effectively whitelisting those applications,” said Peleg Hadar, security researcher with SafeBreach Labs in a Thursday advisory.
The vulnerability (CVE-2019-6333) has a CVSS score of 6.7 out of 10.0, which translates to medium severity. However researchers say that they view the flaw as critical. Under a post-infection scenario an adversary could use the flaw to surreptitiously carry out attacks.
Click to expand...

The Vulnerability
The main attack vector is DLL hijacking, a way for attackers to execute unexpected code on machines.
In this situation, Open Hardware Monitor does not properly check DLLs before loading them.

Once abused, the vulnerability could allow an attacker to launch an array of other malicious activities.
Click to expand...

Log in or Sign up

HP Touchpoint Analytics Opens PCs to Code Execution Attack

guest Guest

Log in or Sign up

HP Touchpoint Analytics Opens PCs to Code Execution Attack

guest Guest

Useful Searches