📄 Description (English)
BlueStacks App Player 2.4.44.62.57 contains an unquoted service path vulnerability in the BstHdLogRotatorSvc service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe to inject malicious executables and escalate privileges.
🤖 AI Executive Summary
CVE-2019-25293 is a local privilege escalation vulnerability in BlueStacks App Player 2.4.44.62.57 affecting the BstHdLogRotatorSvc service through an unquoted service path. Attackers with local access can inject malicious executables to achieve arbitrary code execution and privilege escalation. While no public exploit is available, the vulnerability poses a significant risk to organizations using BlueStacks for mobile app testing and development.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 27, 2026 03:07
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability primarily impacts Saudi technology companies, software development firms, and financial institutions using BlueStacks for mobile app testing and QA operations. High-risk sectors include: Banking and Financial Services (SAMA-regulated entities testing mobile banking apps), Government IT departments (NCA oversight), Telecommunications (STC, Mobily testing mobile services), and Software Development Companies. The vulnerability allows local privilege escalation, which could lead to unauthorized access to sensitive development environments, intellectual property theft, and compromise of financial applications under development.
🏢 Affected Saudi Sectors
Software Development and QA
Banking and Financial Services
Government and Public Administration
Telecommunications
Technology and IT Services
Mobile App Development
🎯 MITRE ATT&CK Techniques
T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1547.011 - Boot or Logon Autostart Execution: Services
T1134.003 - Access Token Manipulation: Make and Impersonate Token
T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt
T1574.008 - Hijack Execution Flow: DLL Search Order Hijacking
T1036.005 - Masquerading: Match Legitimate Name or Location
T1053.005 - Scheduled Task/Job: Scheduled Task
⚖️ Saudi Risk Score (AI)
6.8
/ 10.0
🔧 Remediation Steps (English)
Immediate Actions:
1. Identify all systems running BlueStacks App Player 2.4.44.62.57 or earlier versions
2. Restrict local access to systems running BlueStacks through access controls and user privilege management
3. Disable or remove the BstHdLogRotatorSvc service if not actively required
Patching Guidance:
1. Upgrade BlueStacks App Player to version 2.4.45 or later immediately
2. Verify the service path is properly quoted after upgrade
3. Test functionality in non-production environments before production deployment
Compensating Controls (if immediate patching not possible):
1. Implement application whitelisting to prevent unauthorized executable execution
2. Monitor and log all service creation and modification events
3. Restrict user permissions to prevent local code execution
4. Use Windows AppLocker to control executable execution in Program Files directories
Detection Rules:
1. Monitor for suspicious file creation in C:\Program Files (x86)\Bluestacks\ directory
2. Alert on BstHdLogRotatorSvc service path modifications
3. Track process execution from unexpected locations with similar names to HD-LogRotatorService.exe
4. Monitor Windows Event Log for service creation/modification events (Event ID 7045)
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تحديد جميع الأنظمة التي تقوم بتشغيل BlueStacks App Player الإصدار 2.4.44.62.57 أو الإصدارات الأقدم
2. تقييد الوصول المحلي للأنظمة التي تقوم بتشغيل BlueStacks من خلال عناصر التحكم في الوصول وإدارة امتيازات المستخدم
3. تعطيل أو إزالة خدمة BstHdLogRotatorSvc إذا لم تكن مطلوبة بنشاط
إرشادات التصحيح:
1. ترقية BlueStacks App Player إلى الإصدار 2.4.45 أو أحدث على الفور
2. التحقق من أن مسار الخدمة مقتبس بشكل صحيح بعد الترقية
3. اختبار الوظائف في بيئات غير الإنتاج قبل نشر الإنتاج
عناصر التحكم التعويضية (إذا لم يكن التصحيح الفوري ممكناً):
1. تنفيذ قائمة بيضاء للتطبيقات لمنع تنفيذ ملفات تنفيذية غير مصرح بها
2. مراقبة وتسجيل جميع أحداث إنشاء وتعديل الخدمة
3. تقييد أذونات المستخدم لمنع تنفيذ الكود المحلي
4. استخدام Windows AppLocker للتحكم في تنفيذ الملفات التنفيذية في دلائل Program Files
قواعد الكشف:
1. مراقبة إنشاء ملفات مريبة في دليل C:\Program Files (x86)\Bluestacks\
2. تنبيه عند تعديلات مسار خدمة BstHdLogRotatorSvc
3. تتبع تنفيذ العملية من مواقع غير متوقعة بأسماء مشابهة لـ HD-LogRotatorService.exe
4. مراقبة سجل أحداث Windows لأحداث إنشاء/تعديل الخدمة (معرف الحدث 7045)
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
A.5.1.1 - Information security policies and procedures
A.5.2.1 - User access management
A.5.2.3 - Management of privileged access rights
A.5.3.1 - Password management
A.6.1.1 - Segregation of duties
A.6.2.1 - Event logging
A.6.2.2 - Protection of log information
🔵 SAMA CSF
Governance and Risk Management - Risk Assessment and Management
Information and Cybersecurity - Access Control and Authentication
Information and Cybersecurity - Monitoring and Incident Management
Operational Resilience - System Hardening and Configuration Management
🟡 ISO 27001:2022
A.5.1.1 - Policies for information security
A.5.2.1 - User registration and de-registration
A.5.2.3 - Management of privileged access rights
A.5.3.1 - Password management
A.6.1.1 - Segregation of duties
A.6.2.1 - Event logging
A.6.2.2 - Protection of log information
A.8.1.1 - User endpoint devices