Tools

Unquoted Path (SMB Login) Vulnerability (CVE-2021-35230) in Kiwi CatTools

As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. To mitigate the risk on Kiwi CatTools 3.11.8 and earlier, users should upgrade to KCT 3.12.

First published date

10/18/2021 7:33 PM

Last published date

12/9/2021 7:13 PM

Overview

As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry.

Example vulnerable path: Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kiwi Syslog Server\Parameters\Application.

To mitigate the risk on Kiwi CatTools 3.11.8 and earlier, please upgrade to KCT 3.12. If an upgrade is not possible at this time, please refer to the Resolution section below for workaround details.

Product section

Kiwi CatTools

Cause

CVE-2021-35320

Resolution

Kiwi CatTools 3.12

SolarWinds recommends all users upgrade to Kiwi CatTools 3.12, which was released on October 19, 2021.

Kiwi CatTools 3.11.8 and earlier

If an upgrade is not possible at this time, to mitigate this issue on version 3.11.8 or earlier, use the following workaround.

We advise you to back up the registry and snapshot the server prior to making the following changes and stopping services before taking action.

Change the Service path to contain quotes to remove this vulnerability with the install package.
Find the file path Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CatTools\ImagePath - REG_EXPAND_SZ
Change the path C:\Program Files (x86)\CatTools\nssm.exe to "C:\Program Files (x86)\CatTools\nssm.exe".

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts, or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.