Local Privilege Escalation via Race Condition

An attacker with local access the to medical office computer can

escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by

exploiting a race condition in the Elefant Update Service during the

repair or update process. When using the repair function, the service queries the server for a

list of files and their hashes. In addition, instructions to execute

binaries to finalize the repair process are included. The executables are executed as "NT AUTHORITY\SYSTEM" after they are

copied over to the user writable installation folder (C:\Elefant1). This

means that a user can overwrite either "PostESUUpdate.exe" or

"Update_OpenJava.exe" in the time frame after the copy and before the

execution of the final repair step. The overwritten executable is then executed as "NT AUTHORITY\SYSTEM".