Loading vulnerability…
Privilege Escalation via Unquoted Service Path in ActFax 10.10
ActFax 10.10 contains an unquoted service path flaw in the ActiveFaxServiceNT service configuration. A local user able to write to applicable Program Files directories can place a malicious executable at a path searched because of the unquoted service command. When the service restarts, the malicious executable may run with elevated system privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow a local attacker to obtain elevated system access.
If you can’t patch tonight, do this now.
Until the service path is corrected, restrict write access to applicable Program Files directories and monitor or control restarts of the ActiveFaxServiceNT service.
Patch, then assume compromise.
Quote the ActiveFaxServiceNT service executable path in its service configuration. Verify and restrict write permissions on applicable Program Files directories so unprivileged users cannot place executables in locations that may be searched by the service.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.