CVE-2019-19741 Privilege escalation in n/a
Local attackers can escalate privileges by manipulating directory DACLs via a named pipe vulnerability in the EA Origin client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-19741?
CVE-2019-19741 is a high-severity vulnerability in n/a, published on 20 Feb 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and CVE-2019-19248. When Origin.exe connects to the named pipe OriginClientService, the privileged service verifies the client's executable file instead of its in-memory process (which can be significantly different from the executable file due to, for example, DLL injection). Data transmitted over the pipe is encrypted using a static key. Instead of hooking the pipe communication directly via WriteFileEx(), this can be bypassed by hooking the EVP_EncryptUpdate() function of libeay32.dll. The pipe takes the command CreateDirectory to create a directory and adjust the directory DACL. Calls to this function can be intercepted, the directory and the DACL can be replaced, and the manipulated DACL is written. Arbitrary DACL write is further achieved by creating a hardlink in a user-controlled directory that points to (for example) a service binary. The DACL is then written to this service binary, which results in escalation of privileges.
Which versions are affected by CVE-2019-19741?
It affects 1 product.
Products include Ea Origin.
How do I fix CVE-2019-19741?
No fix has been published for CVE-2019-19741 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-19741 being exploited?
There is no known exploitation of CVE-2019-19741 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vqv8-6rvx-qwf6.