Altiris WMI Provider Local File Read Vulnerability

Executive Summary

This vulnerability involves the Altiris WMI provider exposing a class that allows any local standard user to read files accessible to the SYSTEM account without needing admin privileges. The provider runs in LocalSystem context when handling WMI queries, bypassing normal filesystem ACLs.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability allows local standard users to read SYSTEM-readable files via the Altiris WMI provider. Detection involves checking for unauthorized access to sensitive files or unusual WMI queries. Use commands like 'wmic /namespace:\\root\altiris path AltirisAgent_Stream get *' to query the provider and inspect file access patterns. Monitor system logs for unexpected file reads by non-admin users.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local standard user access could read sensitive files like configuration files, service logs, or secrets that are normally restricted to SYSTEM or Administrator accounts. This could lead to information disclosure or further exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and protection of sensitive data, such as GDPR's data protection principles or HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation includes restricting access to the Altiris WMI provider. Disable the provider if not required using 'wmic /namespace:\\root\altiris path __Namespace.ExecMethod' with appropriate parameters. Apply least-privilege principles by ensuring only authorized users can access SYSTEM-readable files. Update Altiris software to a patched version if available.

Useful 0 Not Useful 0