GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 10.0.9p2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
GFI/Kerio Connect's Outlook Connector (Offline Edition) (KOFF) is affected, allowing a local user without administrator rights to gain full SYSTEM-level control of the machine. This happens because weak file permissions let ordinary users replace a service program that runs with the highest system privileges.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.exe service binary used by the bundled KOFFIndexingService, which runs as LocalSystem, to execute arbitrary code with NT AUTHORITY\SYSTEM privileges upon the next service start or reboot.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- GFI USA, LLC GFI KerioConnect
fixed in 10.0.9p2