bugtraq - [Wintercore Research] Consona Products

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4BE3F35A.5040200@wintercore.com>
Date: Fri, 07 May 2010 13:02:50 +0200
From: vulns@...tercore.com
To: bugtraq@...urityfocus.com
Subject: [Wintercore Research] Consona Products - Multiple vulnerabilities

Affected products:

Consona Live Assistance
Consona Dynamic Agent
Consona Subscriber Assistance

Vulnerabilities:

-XSS
-Remote Code Execution
-Buffer Overflow
-Privilege escalation

Executive summary:

Consona products uses a propietary ActiveX site-lock mechanism that can
be defeated through XSS attacks.

Once an attacker can inject arbitrary JS code within the context of an
allowed domain,  unsafe methods can invoked to download and execute
arbitrary binaries.

A local privilege escalation flaw discovered in the Consona's Repair
Service can be used to bypass IE8 Protected Mode, thus gaining SYSTEM
privileges.

The XSS flaw leds to a complete system compromise.

Technical Details:

These vulnerabilities were discovered and presented, 2 months ago, by
Ruben Santamarta at RootedCon, a security conference held in Madrid.

Slides
http://www.wintercore.com/downloads/rootedcon_0day_english.pdf

References:

[+]
http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html

[+] http://www.kb.cert.org/vuls/id/602801

[+]
http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf

-- 
Wintercore Iberia S.L.

C/ Castellana 122, 1º Derecha

28045 MADRID - SPAIN

www.wintercore.com