Arbitrary File Deletion in Tanium End-User Notifications Endpoint Tools

Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.

• End-User Notifications versions 1.18.0 through before 1.18.10079 are affected.
• End-User Notifications versions 10.0.0 through before 10.0.14 are affected.
• End-User Notifications versions 10.1.0 through before 10.1.20 are affected.
• For the Tanium 7.4 and 7.5 releases, Tanium lists End-User Notifications before 1.18.1112 as affected.
• For the 2024H1 release, Endpoint Configuration Toolset Solution before Update 16, corresponding to v1.40.48, is listed as affected.
• For the 2024H2 release, Endpoint Configuration Toolset Solution before Update 5, corresponding to v1.47.16, is listed as affected.
• The status of other branches or products is not established by the available evidence.

Tanium End-User Notifications Endpoint Tools contains a weakness classified as CWE-59, where link handling before file access is not properly protected. At a high level, a local attacker with privileged access to a system running the Tanium Client could cause the tool to operate on an unintended file or filesystem target, resulting in arbitrary file deletion or overwrite. Tanium does not disclose the exact file-handling routine, path, link condition, or payload, so the precise implementation sequence remains unknown. The confirmed scope includes the affected End-User Notifications branches and the Endpoint Configuration Toolset Solution branches identified by the vendor advisory.

The vulnerability is locally reachable on a system running the Tanium Client and does not require user interaction. The normalized record describes low attack complexity, but the supplied scoring data is inconsistent about the exact privilege requirement: one Tanium entry indicates lower privileges, while NVD indicates higher privileges; Tanium's advisory describes the condition as privileged access. The record marks public exploit as false, but that does not establish that exploitation has never occurred. No specific campaign, victim, payload, or observed exploitation is identified in the supplied evidence.

The direct technical outcome is arbitrary file deletion or overwrite, which can compromise filesystem integrity and may affect system availability. Exploitation requires local access and suitable privileges on a system running the Tanium Client; the normalized data indicates that user interaction is not required. The vulnerability is not described as crossing a security scope boundary or affecting other systems. An organization may need to restore files, repair configuration, or address service interruption if critical files are affected, but the actual extent depends on the filesystem permissions and targets reachable by the tool.

The vulnerability could allow a local user with suitable access to delete or overwrite files that the tool should not be able to modify. Potential consequences include configuration changes, data corruption, or service disruption if important files are removed or altered. The practical scope depends on the process permissions, filesystem permissions, and files reachable by the operation; those details are not fully disclosed. The supplied impact data does not identify reading or disclosure of file contents as an outcome.

1. Upgrade End-User Notifications out of the affected ranges and use the confirmed version boundaries 1.18.10079, 10.0.14, or 10.1.20 for the applicable branch.
2. For Tanium 7.4 and 7.5 deployments, update End-User Notifications to v1.18.1112 or a later release as directed by Tanium.
3. For the 2024H1 branch, update Endpoint Configuration Toolset Solution to Update 16, corresponding to v1.40.48, or a later release.
4. For the 2024H2 branch, update Endpoint Configuration Toolset Solution to Update 5, corresponding to v1.47.16, or a later release.
5. Tanium on-premises customers using ECM should use Change Management in Endpoint Configuration to deploy Manifest 2.2.135 or 2.9.34 as directed by the vendor. Tanium Cloud customers using ECM should deploy Manifest 2.11.44 or 2.12.43.
6. Tanium lists no workaround or mitigation. After upgrading, revalidate inventory across all endpoints rather than checking only the management server.

1. Inventory endpoints running the Tanium Client and determine whether End-User Notifications or Endpoint Configuration Toolset Solution is installed.
2. Compare End-User Notifications versions against the 1.18, 10.0, and 10.1 branches, and check the Tanium 7.4, 7.5, 2024H1, and 2024H2 branches named by the vendor advisory.
3. Check Endpoint Configuration Toolset Solution versions and the ECM Manifests deployed to endpoints, particularly in on-premises and Tanium Cloud environments.
4. Review filesystem telemetry for unusual deletion or overwrite activity performed by Tanium processes, but treat this as precautionary monitoring because the source provides no specific log event or IOC.
5. Absence of suspicious log activity does not prove that an endpoint is safe; confirm exposure through inventory and version reconciliation.