Local File Overwrite Vulnerability in Thales Safenet Authentication Client for Windows and Linux
CVE-2021-42056

6.7MEDIUM

Key Information:

Vendor

Thalesgroup

Status
Safenet Authentication Client
Vendor
CVE Published:
24 June 2022

Badges

👾 Exploit Exists

What is CVE-2021-42056?

The Thales Safenet Authentication Client for Windows and Linux, including versions up to 10.7.7, is susceptible to a local file overwrite vulnerability due to the creation of insecure temporary HID and lock files. This flaw can be exploited by a local attacker using a symlink attack, allowing them to overwrite arbitrary files. The successful exploitation of this vulnerability can lead to unauthorized command execution with elevated privileges.

References

https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056
x_refsource_MISC

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.