bugtraq - Intel wireless service s24evmon.exe confidential information disclosure.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 2 May 2006 18:59:54 -0000
From: ruben@...ersemode.com
To: bugtraq@...urityfocus.com
Subject: Intel wireless service s24evmon.exe confidential information
 disclosure.

S24EvMon.exe is a service which is part (at least) of the Intel PROset/Wireless software. This application is provided by Intel in order to support intel Wireless Devices based on Spectrum 24 chipsets.

This service uses a shared memory section which is created without the proper security descriptor, allowing unprivileged users to perform operations like Delete, Read or Write into the memory. The section is named “S24EventManagerSharedMemory”

This shared memory is used to store ,in plain text, confidential information like WEP Key, Passwords...

The successful exploitation of this vulnerability could allow to any unprivileged user to access confidential information,exposing the network. An important mitigating factor is that the vulnerability is local, nevertheless some Malware could take advantage of this flaw.

Further information and exploit code at www.reversemode.com

Regards,
Rubén