Vulnerability · Published Mar 25, 2021 · Assigned by cisco

CVE-2021-1492Duo Authentication Proxy Installer Denial of Service Vulnerability

Medium 6.6

In plain English

A medium-severity security flaw in Duo Authentication Proxy from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.3%top 79.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Duo Authentication Proxy installer, cause Denial of Service (DoS) by deleting file(s), or replace system files to potentially achieve elevation of privileges. This is only exploitable during new installations, while the installer is running, and is not exploitable once installation has finished. Versions 5.2.1 of Duo Authentication Proxy installer addresses this issue.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Duo Authentication Proxy	unspecified – before 5.2.1

Weakness: CWE-64 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

References

https://help.duo.com/s/article/6789 vendor-advisory, x_refsource_CISCO