CVE-2019-12042 Privilege escalation in n/a
Attackers can escalate privileges by queuing events to the AgentSvc.exe service due to insecure permissions on shared memory objects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-12042?
CVE-2019-12042 is a critical vulnerability in n/a, published on 23 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event Global\PandaDevicesAgentSharedMemoryChange in Panda products before 18.07.03 allow attackers to queue an event (as an encrypted JSON string) to the system service AgentSvc.exe, which leads to privilege escalation when the CmdLineExecute event is queued. This affects Panda Antivirus, Panda Antivirus Pro, Panda Dome, Panda Global Protection, Panda Gold Protection, and Panda Internet Security.
Weakness: CWE-732
Which versions are affected by CVE-2019-12042?
It affects 6 products.
Products include Pandasecurity Panda Antivirus, Pandasecurity Panda Antivirus Pro, Pandasecurity Panda Dome, Pandasecurity Panda Global Protection, Pandasecurity Panda Gold Protection, Pandasecurity Panda Internet Security.
How do I fix CVE-2019-12042?
No fix has been published for CVE-2019-12042 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-12042 being exploited?
There is no known exploitation of CVE-2019-12042 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-qjwh-v6w7-c84w.