CVE-2015-3449
HighSummary
The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, allowing local users to gain privileges via a Trojan horse XeService.exe file.
Risk Assessment
Weak permissions may lead to privilege escalation by local users, posing a risk of introducing malware into the system.
Recommendation
It is recommended to change the install folder permissions to restrict access to trusted users only.
Other vulnerabilities in SAP Afaria 7.0.6398.0
See all- CVE-2015-4161High
SAP Afaria does not properly restrict access to unspecified functionality, allowing remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact.
- CVE-2015-2816High
The XcListener in SAP Afaria 7.0.6001.5 does not properly restrict access, allowing remote attackers to have unspecified impact via a crafted request.
- CVE-2015-8753Critical
SAP Afaria version 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related to 'Insecure signature.'
Original NVD description (English source)
The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file.