> Source: [sk180044](https://support.checkpoint.com/results/sk/sk180044)

# sk180044 - Possible privilege escalation in Check Point Endpoint Security

| Property | Value |
|----------|-------|
| Solution ID | sk180044 |
| Date Created | 2022-10-04 |
| Last Modified | 2022-10-06 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | Windows |

## Solution

### Background

Improper handling of registry symbolic links can be exploited by attackers to cause Check Point to unintentionally delete privileged registry keys including its own registry keys.

In Windows, when you delete a registry key that was configured as a symbolic link, the deletion is done on the target registry key that the symlink points to unless specified otherwise with a special flag.

Check Point's system service (epam_svc.exe) can be fooled to delete any arbitrary registry key in these ways:

* Find a registry key that Check Point's system services delete.
* Craft a registry key that will be detected as malicious and eventually be deleted as part of the malware cleaning procedure.

The issue is related to E1.

### Impact

Attackers can exploit this vulnerability to gain more privileges on the system. For example:

* If the attackers have access to write to HKLM, they can create a registry symlink that points to Check Point protection service registry keys to disable the runtime protection, for example to bypass detection.
* Standard users can take advantage of this vulnerability to gain control over the "policies" registry key to set/remove policies that by default they do not have permissions for on Windows. One interesting policy is "AlwaysInstallElevated" which can be set for a standard profile, thereby allowing it to gain elevated privileges, as that policy is set per machine.

* Attackers might be able to find other ways to take advantage of this, similar to the vulnerability that was disclosed [here](https://bugs.chromium.org/p/project-zero/issues/detail?id=99&can=1&q=reporter%3Ame&redir=1).

### Fix

Update the Anti-Malware blade. The Anti-Malware update with the fix was released in October 2022.

To check that the issue is fixed:

Check that the Signature Version of Anti-Malware blade is greater than **202210022141**.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content