CVE-2022-2191

Related Files

Red Hat Security Advisory 2023-0189-01

Posted Jan 18, 2023

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-0189-01 - Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat AMQ Streams 2.3.0 serves as a replacement for Red Hat AMQ Streams 2.2.0, and includes security and bug fixes, and enhancements. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service

systems | linux, redhat

advisories | CVE-2022-2047, CVE-2022-2048, CVE-2022-2191, CVE-2022-38752, CVE-2022-42003, CVE-2022-42004

SHA-256 | 890be5c5d27ca09a0cfafdb4527e34cc5f1ad5257a592ecaece812f81c4d160b

Download | Favorite | View

Windows User Profile Service Privlege Escalation

Posted Apr 11, 2022

Authored by Grant Willcox, KLINIX5 | Site metasploit.com

The user profile service, identified as ProfSrv, is vulnerable to a local privilege elevation vulnerability in its CreateDirectoryJunction() function due to a lack of appropriate checks on the directory structure of the junctions it tries to link together. Attackers can leverage this vulnerability to plant a malicious DLL in a system directory and then trigger a UAC prompt to cause this DLL to be loaded and executed by ProfSrv as the NT AUTHORITY\SYSTEM user. Note that this bug was originally identified as CVE-2021-34484 and was subsequently patched a second time as CVE-2022-21919, however both patches were found to be insufficient. This bug is a patch bypass for CVE-2022-21919 and at the time of publishing, has not yet been patched, though plans are in place to patch it as CVE-2022-26904.

systems | windows

advisories | CVE-2021-34484, CVE-2022-21919, CVE-2022-26904

SHA-256 | d30eae074af8b00dd694a057dd1c7a07694de0851d5e48da9ee462ed23d2a3ce

Download | Favorite | View