📄 الوصف (الإنجليزية)
Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can insert malicious executables in Program Files (x86) or system root directories to be executed with SYSTEM-level permissions during service startup.
🤖 ملخص AI
CVE-2020-37059 is a local privilege escalation vulnerability in Popcorn Time 6.2.1.14 exploiting unquoted service paths, allowing non-privileged users to execute arbitrary code with SYSTEM privileges. While no public exploit exists, the vulnerability is straightforward to exploit and poses significant risk in multi-user environments. Immediate patching is critical for organizations where Popcorn Time is deployed on Windows systems.
📄 الوصف (العربية)
🤖 التحليل الذكي آخر تحليل: Apr 27, 2026 15:03
🇸🇦 التأثير على المملكة العربية السعودية
Impact is limited to organizations using Popcorn Time on Windows systems. Primary risk sectors include: Government agencies (if used on workstations), Educational institutions, and Corporate environments with BYOD policies. Banking and critical infrastructure (ARAMCO, STC) are unlikely to be affected due to strict application whitelisting policies. However, the vulnerability could be exploited in government offices or universities where media streaming applications may be installed on employee workstations, potentially compromising sensitive data or enabling lateral movement.
🏢 القطاعات السعودية المتأثرة
Government
Education
Corporate/Enterprise
Healthcare (if Popcorn Time installed on workstations)
🎯 تقنيات MITRE ATT&CK
⚖️ درجة المخاطر السعودية (AI)
6.2
/ 10.0
🔧 Remediation Steps (English)
1. IMMEDIATE ACTIONS:
- Identify all systems running Popcorn Time 6.2.1.14 or earlier versions using endpoint detection tools
- Restrict local user access to Program Files (x86) and system root directories via NTFS permissions
- Disable or remove Popcorn Time service if not business-critical
2. PATCHING:
- Upgrade Popcorn Time to version 6.2.2 or later immediately
- Verify service path is properly quoted in Windows Registry (HKLM\SYSTEM\CurrentControlSet\Services\)
3. COMPENSATING CONTROLS (if patching delayed):
- Implement AppLocker or Windows Defender Application Control to prevent execution from Program Files (x86)
- Apply principle of least privilege; restrict local admin rights
- Monitor service startup events (Event ID 7045) for suspicious service creation
4. DETECTION:
- Monitor for file creation in Program Files (x86) by non-admin users
- Alert on service startup with unquoted paths containing spaces
- Review Windows Event Viewer for privilege escalation attempts (Event ID 4688 with elevated tokens)
🔧 خطوات المعالجة (العربية)
1. الإجراءات الفورية:
- تحديد جميع الأنظمة التي تقوم بتشغيل Popcorn Time 6.2.1.14 أو الإصدارات الأقدم باستخدام أدوات الكشف عن نقاط النهاية
- تقييد وصول المستخدم المحلي إلى Program Files (x86) ومجلدات جذر النظام عبر أذونات NTFS
- تعطيل أو إزالة خدمة Popcorn Time إذا لم تكن حرجة للعمل
2. التصحيح:
- ترقية Popcorn Time إلى الإصدار 6.2.2 أو أحدث فوراً
- التحقق من أن مسار الخدمة مقتبس بشكل صحيح في سجل Windows
3. الضوابط البديلة (إذا تأخر التصحيح):
- تطبيق AppLocker أو Windows Defender Application Control لمنع التنفيذ من Program Files (x86)
- تطبيق مبدأ أقل امتياز؛ تقييد حقوق المسؤول المحلي
- مراقبة أحداث بدء الخدمة (Event ID 7045) للخدمات المريبة
4. الكشف:
- مراقبة إنشاء الملفات في Program Files (x86) من قبل المستخدمين غير المسؤولين
- تنبيه عند بدء الخدمة بمسارات غير مقتبسة تحتوي على مسافات
- مراجعة Windows Event Viewer لمحاولات تصعيد الامتيازات
📋 خريطة الامتثال التنظيمي
🟢 NCA ECC 2024
A.5.1.1 - Information security policies and procedures
A.8.1.1 - User access management and least privilege
A.12.2.1 - Change management procedures
A.12.6.1 - Management of technical vulnerabilities
🔵 SAMA CSF
ID.AM-2 - Asset management and inventory
PR.AC-1 - Access control and least privilege
PR.PT-2 - Protective technology deployment
DE.CM-8 - Vulnerability scanning and management
🟡 ISO 27001:2022
A.5.1 - Management direction for information security
A.8.1 - User access management
A.12.2 - Change management
A.12.6 - Management of technical vulnerabilities and exposures