Digital Guardian Windows Agent RME Security Bypass Vulnerability (CVE-2024-3334) and Remediation

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Issue: A security bypass vulnerability exists in the Removable Media Encryption (RME) component of the Digital Guardian Windows Agent. This vulnerability allows users to bypass encryption controls by modifying metadata on USB devices, thereby compromising the confidentiality of future stored data. - Affected Scope: The vulnerability affects Digital Guardian Windows Agent versions 8.2.0 and earlier. - CVE ID: CVE-2024-3334. 2. Solution: - Upgrade: Upgrade the Windows Agent to version 8.2.0 or later. - Deployment: Deploy the Windows DLP Control Policy Pack v4.1 and ensure the rule "DLP1028-P-Verify RME is Active" is enabled. If no longer using the content pack or using deprecated alternative RME policies, the standalone rule "DLP1028-P-Standalone Verify RME is Active" can be used. 3. Alternative RME Policies: - Multiple alternative RME policies are provided, including: - DLP - Classified RME USB Enterprise alternative - DLP - Classified RME USB Portable alternative - DLP - Classified RME USB User Decision alternative - DLP - RME USB Enterprise alternative - DLP - RME USB Portable alternative - DLP - RME USB User Decision alternative 4. Rule Logic: - Example rule logic is provided for executing actions under specific conditions. For instance, when the target drive does not support encryption, the target drive is removable, and the operation is file copy, move, or rename, the rule will trigger specific actions. This information helps users understand the nature and scope of the vulnerability, as well as how to resolve it by upgrading and deploying specific policies.

Goal Reached Thanks to every supporter — we hit 100%!

Digital Guardian Windows Agent RME Security Bypass Vulnerability (CVE-2024-3334) and Remediation