FAQs for Insecure Folder Permissions in the Windows VEN
Review these FAQs.
What software components are affected?
The Illumio VEN for Windows is impacted by this vulnerability, specifically the folder permissions set by the VEN installer. VENs on Linux and other platforms are unaffected.
What products did this effect?
This vulnerability impacts the Windows VEN used with the Illumio PCE.
Is Core SaaS affected?
The vulnerability affects Windows VENs paired with a SaaS PCE. The SaaS environment is unaffected.
I’m using CloudSecure. Am I impacted?
No, you are not impacted.
What does the fix change?
The fixed releases remediate the permission vulnerability created by the Windows installer.
I can’t apply the patch immediately. How can I mitigate the issue in the meantime?
The vulnerability requires the attacker to already have code execution as LOCAL SERVICE on the Windows host. Keep services running under this account patched and remove any that are unnecessary.
How long will the upgrade take?
The fix is provided in a normal VEN release, so it takes the same amount of time as any VEN upgrade.
Were any Illumio customers impacted by this vulnerability?
Illumio is not aware of any exploitation of this vulnerability within any customer environments.