Severity Rating: MEDIUM
Software Affected
Docker Desktop Community version 2.3.0.2
Overview
A vulnerability has been reported in Windows Docker Desktop Service that
could allow an attacker to gain elevated privileges on a targeted system.
Description
This vulnerability exists in the Docker Desktop for Windows when
communicating as a client to child processes. An attacker could exploit
this vulnerability by connecting the affected software to a named pipe
which is set up by a malicious lower privilege process.
Successful exploitation of this vulnerability could allow the attacker to
impersonate the Docker Desktop Service account (SYSTEM) and execute
arbitrary system commands with the highest level privileges.
Solution
Apply updates as available on
Vendor Information
Docker
References
Docker
Zdnet
- -docker-desktop-for-windows/
CVE Name
CVE-2020-11492
About Cert Advisory
We have created this blog to provide latest security advisory from the india cert for the security vulnerability, threats, attacks and patching required to mitigate any kind of cyber attacks.