Description
System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| winsiderss | System Informer | < 4.0.26241.138 | 4.0.26241.138 |
References
- Patch Commit patch
- https://github.com/winsiderss/systeminformer/blob/v3.2.25011.2103/SystemInformer/phsvc/svcapiport.c#L196-L230 technical-description
- System Informer v4.0.26241.138 Release Notes release-notes
- https://github.com/winsiderss/systeminformer product
- VulnCheck Advisory: System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port third-party-advisory