CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11653 – Razer Synapse 2.20 DLL Hijacking
https://notcve.org/view.php?id=CVE-2017-11653
Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows local users to gain privileges via a Trojan horse (1) RazerConfigNative.dll or (2) RazerConfigNativeLOC.dll file. Razer Synapse 2.20.15.1104 y anteriores emplea permisos débiles para el directorio Devices, lo que permite que usuarios locales obtengan privilegios mediante un archivo troyano (1) RazerConfigNative.dll or (2) RazerConfigNativeLOC.dll. Razer Synapse versions 2.20.15.1104 and below suffer from multiple dll search order hijacking vulnerabilities. • http://packetstormsecurity.com/files/143516/Razer-Synapse-2.20-DLL-Hijacking.html • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 10.0EPSS: 21%CPEs: 1EXPL: 4CVE-2017-9769 – Razer Synapse 2.20.15.1104 - rzpnk.sys ZwOpenProcess
https://notcve.org/view.php?id=CVE-2017-9769
A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened to an arbitrary process. Se podría enviar una llamada IOCTL especialmente manipulada al controlador rzpnk.sys en Razer Synapse 2.20.15.1104 que se reenviaría a ZwOpenProcess, permitiendo que se abra un manipulador para un proceso arbitrario. A vulnerability exists in the latest version of Razer Synapse (v2.20.15.1104 as of the day of disclosure) which can be leveraged locally by a malicious application to elevate its privileges to those of NT_AUTHORITY\SYSTEM. • https://www.exploit-db.com/exploits/42368 https://github.com/kkent030315/CVE-2017-9769 http://www.rapid7.com/db/modules/exploit/windows/local/razer_zwopenprocess https://warroom.securestate.com/cve-2017-9769 •