Login Sign Up

CVE-2019-12594

9.8 CRITICAL

📋 TL;DR

CVE-2019-12594 is an incorrect access control vulnerability in DOSBox 0.74-2 that allows local users to escalate privileges or execute arbitrary code. This affects systems where DOSBox is installed and multiple users have access. The vulnerability stems from improper file permission handling in DOSBox's configuration.

💻 Affected Systems

Products:
  • DOSBox
Versions: 0.74-2
Operating Systems: Linux, Windows, macOS
Default Config Vulnerable: ⚠️ Yes
Notes: Vulnerability exists in the default installation of DOSBox 0.74-2 across all supported platforms.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Dosbox by Dosbox

View all CVEs affecting Dosbox →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local attacker gains root/administrator privileges leading to complete system compromise.

🟠

Likely Case

Local user escalates privileges to execute arbitrary code with elevated permissions.

🟢

If Mitigated

Impact limited to denial of service or configuration corruption if proper user isolation exists.

🌐 Internet-Facing: LOW - This is a local privilege escalation requiring local access.
🏢 Internal Only: MEDIUM - Risk exists in multi-user environments where DOSBox is installed.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires local access but is straightforward once access is obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.74-3 and later

Vendor Advisory: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931222

Restart Required: No

Instructions:

1. Update DOSBox using your package manager (apt-get update && apt-get upgrade dosbox on Debian/Ubuntu). 2. Verify installation of version 0.74-3 or later. 3. No restart required.

🔧 Temporary Workarounds

Restrict DOSBox permissions

linux

Set strict file permissions on DOSBox configuration and executable files

chmod 750 /usr/games/dosbox
chmod 644 /etc/dosbox/*

Remove DOSBox from shared systems

linux

Uninstall DOSBox from multi-user systems where not essential

apt-get remove dosbox

🧯 If You Can't Patch

  • Restrict DOSBox usage to trusted users only
  • Implement strict file system permissions and user isolation

🔍 How to Verify

Check if Vulnerable:

Check DOSBox version: dosbox -version | grep '0.74-2'

Check Version:

dosbox -version

Verify Fix Applied:

Verify version is 0.74-3 or later: dosbox -version

📡 Detection & Monitoring

Log Indicators:

  • Unauthorized file access attempts in DOSBox logs
  • Suspicious privilege escalation attempts

Network Indicators:

  • Not applicable - local vulnerability

SIEM Query:

source="dosbox" AND (event="permission_denied" OR event="access_violation")

📊 Metadata

CVE ID: CVE-2019-12594
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: July 2, 2019
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON