ID
VAR-202010-1014
CVE
CVE-2020-3427
TITLE
Windows Logon installer Vulnerability in handling exceptional conditions in
Trust: 0.8
DESCRIPTION
The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Windows Logon, cause Denial of Service (DoS) by deleting file(s), or replace system files to potentially achieve elevation of privileges. Note that this can only exploitable during new installations while the installer is running and is not exploitable once installation is finished. Versions 4.1.2 of Windows Logon addresses this issue. Windows Logon installer Is vulnerable to handling exceptional conditions.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Duo Network Gateway (DNG) is an access control software developed by Duo Corporation in the United States for accessing internal web applications. The Duo Authentication Windows Logon and RDP implementation has a security vulnerability that stems from a privilege escalation vulnerability in the two-factor authentication implemented
Trust: 1.8
AFFECTED PRODUCTS
| vendor: | cisco | model: | duo authentication for windows logon and rdp | scope: | lt | version: | 4.1.2 | Trust: 1.0 |
| vendor: | シスコシステムズ | model: | duo authentication for windows logon and rdp | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | シスコシステムズ | model: | duo authentication for windows logon and rdp | scope: | eq | version: | 4.1.2 | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-280 | Trust: 1.0 |
| problemtype: | NVD-CWE-noinfo | Trust: 1.0 |
| problemtype: | Improper handling in exceptional conditions (CWE-755) [NVD Evaluation ] | Trust: 0.8 |
| problemtype: | CWE-755 | Trust: 0.1 |
THREAT TYPE
local
Trust: 0.6
TYPE
other
Trust: 0.6
PATCH
| title: | Duo Authentication for Windows Logon and RDP - Release Notes | url: | https://duo.com/docs/rdp-notes | Trust: 0.8 |
| title: | Microsoft Windows Security vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=131280 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-3427 | Trust: 2.6 |
| db: | JVNDB | id: | JVNDB-2020-012744 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202010-633 | Trust: 0.7 |
| db: | VULHUB | id: | VHN-181552 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2020-3427 | Trust: 0.1 |
REFERENCES
| url: | https://duo.com/docs/rdp-notes | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-3427 | Trust: 1.4 |
| url: | https://cwe.mitre.org/data/definitions/755.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
| url: | https://exchange.xforce.ibmcloud.com/vulnerabilities/189806 | Trust: 0.1 |
SOURCES
| db: | VULHUB | id: | VHN-181552 |
| db: | VULMON | id: | CVE-2020-3427 |
| db: | JVNDB | id: | JVNDB-2020-012744 |
| db: | CNNVD | id: | CNNVD-202010-633 |
| db: | NVD | id: | CVE-2020-3427 |
LAST UPDATE DATE
2024-11-23T22:33:16.492000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-181552 | date: | 2022-09-20T00:00:00 |
| db: | VULMON | id: | CVE-2020-3427 | date: | 2020-10-30T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-012744 | date: | 2021-05-26T07:19:00 |
| db: | CNNVD | id: | CNNVD-202010-633 | date: | 2022-09-21T00:00:00 |
| db: | NVD | id: | CVE-2020-3427 | date: | 2024-11-21T05:31:02.883 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-181552 | date: | 2020-10-14T00:00:00 |
| db: | VULMON | id: | CVE-2020-3427 | date: | 2020-10-14T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-012744 | date: | 2021-05-26T00:00:00 |
| db: | CNNVD | id: | CNNVD-202010-633 | date: | 2020-10-14T00:00:00 |
| db: | NVD | id: | CVE-2020-3427 | date: | 2020-10-14T19:15:13.977 |