Web: https://kb.cert.org/vuls/id/730007

April 28, 2022, 1:07 p.m. |

CERT Recently Published Vulnerability Notes cert.org

Overview


Tychon contains a privilege escalation vulnerability due to the use of an OPENSSLDIR variable that specifies a location where an unprivileged Windows user may be able to place files.


Description


Tychon includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that my be controllable by an unprivileged user on Windows. Tychon contains a privileged service that uses this OpenSSL component. A user who can place a specially-crafted openssl.cnf file at an appropriate path may be able …

escalation location privilege privilege escalation vulnerable

Senior Product Security Engineer

@ Panther Labs | United States

Lead, DevSecOps

@ Hex Trust | Singapore, Singapore, Singapore

Information Security GRC Lead

@ Bud | London, England, United Kingdom

Security Analyst

@ AnaVation | Quantico, VA

Security Engineer

@ Homebase | Atlanta, Georgia, United States

Principal Offensive Cloud Security Engineer

@ Uptycs | Remote, USA

Security Engineer

@ AnaVation | Quantico, VA

Information Systems Security Manager

@ Barbaricum | Washington, DC

Cloud Engineer - GCP Security Specialist

@ DoiT International | Remote Israel

Security Operations Analyst - Compliance

@ Algolia | London, England

GRC Lead - Software Compliance

@ Ivanti | United States

Security Administrator

@ Trusting Social | Ho Chi Minh City, Ho Chi Minh City, Vietnam