TDM Digital Signage PC Player 4.1 Insecure File Permissions

🗓️ 26 Oct 2020 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 139 Views

TDM Digital Signage PC Player 4.1 privilege escalation vulnerability due to insecure file permission

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2020-36916	6 Jan 202616:10	–	circl
CNNVD	TDM Digital Signage PC Player 安全漏洞	6 Jan 202600:00	–	cnnvd
CVE	CVE-2020-36916	6 Jan 202615:52	–	cve
Cvelist	CVE-2020-36916 TDM Digital Signage PC Player 4.1.0.4 Privilege Escalation via Insecure Permissions	6 Jan 202615:52	–	cvelist
EUVD	EUVD-2026-1022	6 Jan 202615:52	–	euvd
NVD	CVE-2020-36916	6 Jan 202616:15	–	nvd
Positive Technologies	PT-2026-1450	6 Jan 202600:00	–	ptsecurity
Vulnrichment	CVE-2020-36916 TDM Digital Signage PC Player 4.1.0.4 Privilege Escalation via Insecure Permissions	6 Jan 202615:52	–	vulnrichment

<html><body><p>TDM Digital Signage PC Player 4.1 Insecure File Permissions


Vendor: TDM [Trending Digital Marketing]
Product web page: https://www.tdmsignage.com
                  https://pro.sony/en_NL/products/display-software/tdm-ds1y-tdm-ds3y
Affected version: 4.1.0.4

Summary: With TDM you can do a lot more than just show Digital Signage.
With our Enterprise-Grade software you open the door to Interactive Signage,
Analytics, Proof of Play and a lot more.

Desc: TDM Digital Signage Windows Player suffers from an elevation of
privileges vulnerability which can be used by a simple authenticated
user that can change the executable file with a binary of choice. The
vulnerability exist due to the improper permissions, with the 'M' flag
(Modify) or 'C' flag (Change) for 'Authenticated Users' group.

Tested on: Microsoft Windows 10 Home


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5604
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5604.php

23.09.2020

--


C:\&gt;icacls TDMSignage
TDMSignage BUILTIN\Administrators:(I)(OI)(CI)(F)
           NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
           BUILTIN\Users:(I)(OI)(CI)(RX)
           NT AUTHORITY\Authenticated Users:(I)(M)              &lt;---------&lt;&lt;&lt;
           NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)  &lt;---------&lt;&lt;&lt;

Successfully processed 1 files; Failed processing 0 files

C:\TDMSignage&gt;dir /b *.exe
Player.exe
unins000.exe

C:\TDMSignage&gt;icacls Player.exe &amp;&amp; icacls unins000.exe
Player.exe BUILTIN\Administrators:(I)(F)
           NT AUTHORITY\SYSTEM:(I)(F)
           BUILTIN\Users:(I)(RX)
           NT AUTHORITY\Authenticated Users:(I)(M)              &lt;---------&lt;&lt;&lt;

Successfully processed 1 files; Failed processing 0 files
unins000.exe BUILTIN\Administrators:(I)(F)
             NT AUTHORITY\SYSTEM:(I)(F)
             BUILTIN\Users:(I)(RX)
             NT AUTHORITY\Authenticated Users:(I)(M)            &lt;---------&lt;&lt;&lt;

Successfully processed 1 files; Failed processing 0 files
</p></body></html>

26 Oct 2020 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 48.5

CVSS 3.18.8

EPSS0.00043

SSVC