Security update for Lime CRM Desktop Client update service

Bulletin ID

LCSEC26-10

Date published

[date]

Priority

2

Severity

Critical

Priority and severity ratings are determined as described here.

This security update resolves vulnerabilities in the Lime Maintenance Service, which the Lime CRM Desktop Client installs to install updates. The vulnerabilities enable local Windows users to execute programs with LocalSystem privileges.

Lime CRM Server and Lime Data Components (LDC) are not affected.

All earlier builds of Lime CRM Desktop Client are withdrawn from download.

Upgrade to the newest version of Lime CRM Desktop Client. The upgrade also replaces the Lime Maintenance Service.

Where the client cannot be upgraded at once, install the Lime Maintenance Service update instead. It updates only the service and does not change the client. A user without administrator rights can start it: it asks the installed service to install it, and asks for administrator credentials only when the installed service cannot do so. It only upgrades an installed service. It never installs, uninstalls or downgrades the service. When it cannot upgrade a vulnerable service, it disables that service.

A Lime Maintenance Service of version 12.0.4710 or later contains this update. A computer updated with the Lime Maintenance Service update also has the registry value PatchedVersion under HKLM\SOFTWARE\WOW6432Node\Lime\MaintenanceServiceUpdate.

With the Lime Maintenance Service update, the client stays on its earlier version. The updated service does not run installers that were built before this update, so automatic updates of such a client to another earlier version do not work. Plan the upgrade of the client.

To avoid installing an earlier version that still contains the vulnerabilities by mistake, remove older Lime CRM Desktop Client installers from shared folders, download folders and software deployment systems, and use only 11.3.4710 or later. This also applies when the client is deployed with a tool that installs as SYSTEM, such as Microsoft Configuration Manager or Intune.

A local user could use the Lime Maintenance Service to run programs with LocalSystem privileges. A user who exploited the vulnerabilities would get full control of the computer.

Lime provides technical details to the IT administrators of customers on request. Contact support@lime.tech.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in this situation:

• The attacker must be able to log on to the computer, or already run code as a user on it. The vulnerabilities cannot be exploited over the network alone.
• Lime knows of no exploitation of these vulnerabilities.

Workaround refers to a setting or configuration change that would help block known attack vectors before you apply the update.

• Disable the Lime Maintenance Service until the update is installed. Stopping the service is not enough, because users are allowed to start it again. The service must be disabled.
  • On one computer, run these commands in a Command Prompt started as administrator:

    sc.exe stop LimeMaintenanceService
    sc.exe config LimeMaintenanceService start= disabled

  • On many computers, use Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > System Services > Lime Maintenance Service, startup mode Disabled. The policy only lists the service when the computer that edits the policy has it installed.
  • Impact: automatic updates of Lime CRM Desktop Client do not work while the service is disabled. An administrator can still install the update manually.
  • After the update, remove the Group Policy setting if you used one, and enable the service again on each computer. The startup mode a policy has set stays on the computer after the setting is removed.

    sc.exe config LimeMaintenanceService start= demand