CVE-2024-23758
📋 TL;DR
This vulnerability in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information stored in the EnterpriseManagementInstaller_msi.log file. Organizations using this specific version of Unisys Stealth are affected by this information disclosure vulnerability.
💻 Affected Systems
- Unisys Stealth
📦 What is this software?
Stealth by Unisys
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access credentials, configuration details, or other sensitive data that could lead to further system compromise or data exfiltration.
Likely Case
Unauthorized users gain access to sensitive system information that could be used for reconnaissance or to facilitate other attacks.
If Mitigated
With proper access controls and monitoring, the impact is limited to potential information leakage without direct system compromise.
🎯 Exploit Status
Exploitation requires access to the log file location, which typically requires some level of system access
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest version beyond 5.3.062.0
Vendor Advisory: https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=70
Restart Required: Yes
Instructions:
1. Download latest Unisys Stealth version from vendor portal
2. Backup current configuration
3. Run installer with administrative privileges
4. Restart affected systems
5. Verify installation and functionality
🔧 Temporary Workarounds
Restrict log file permissions
windowsSet strict file permissions on the EnterpriseManagementInstaller_msi.log file to prevent unauthorized access
icacls "C:\Path\To\EnterpriseManagementInstaller_msi.log" /inheritance:r /grant:r "SYSTEM:(F)" "Administrators:(F)"
Move or rename log file
windowsRelocate the log file to a more secure location or rename it to obscure its purpose
move "C:\Path\To\EnterpriseManagementInstaller_msi.log" "C:\Secure\Location\NewName.log"
🧯 If You Can't Patch
- Implement strict access controls on the directory containing the log file
- Enable auditing and monitoring for access attempts to the sensitive log file
🔍 How to Verify
Check if Vulnerable:
Check if Unisys Stealth version 5.3.062.0 is installed and if the EnterpriseManagementInstaller_msi.log file exists with sensitive informationCheck Version:
Check Unisys Stealth version in Control Panel > Programs and Features or via vendor-specific version check commandVerify Fix Applied:
Verify Unisys Stealth version is updated beyond 5.3.062.0 and check that log file no longer contains sensitive information or is properly secured📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to EnterpriseManagementInstaller_msi.log file
- File permission changes on the log file
Network Indicators:
- Unusual file access patterns from non-admin accounts
SIEM Query:
EventID=4663 AND ObjectName LIKE '%EnterpriseManagementInstaller_msi.log%' AND NOT SubjectUserName IN ('SYSTEM', 'Administrator')