full-disclosure - Vulnerability in "Fujitsu Desktop Update" (for Windows)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5860F714D9534A71B5F2647B599B1C6B@localhost>
Date: Wed, 8 May 2013 22:57:49 +0200
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: <bugtraq@...urityfocus.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Vulnerability in "Fujitsu Desktop Update" (for
	Windows)

Hi @ll,

Fujitsu's update utility "Fujitsu Desktop Update" (see
<http://support.ts.fujitsu.com/DeskUpdate/Index.asp>), which is
factory-preinstalled on every Fujitsu (Siemens) PC with Windows,
has a vulnerability which allows the execution of a rogue program
in the security context of the current user.


The application is registered as control panel item via

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{070B64FF-795D-4DAA-88AD-6D3277C7E445}]
@="Fujitsu DeskUpdate"


The "shell object" with GUID {070B64FF-795D-4DAA-88AD-6D3277C7E445} is
registered with

[HKLM\SOFTWARE\Classes\CLSID\{070B64FF-795D-4DAA-88AD-6D3277C7E445}]
@="Fujitsu DeskUpdate"
"InfoTip"=expand:"@C:\\Program Files (x86)\\Fujitsu\\DeskUpdate\\DeskUpdate.exe,-132"
"System.ControlPanel.Category"=dword:00000005
"System.Software.TasksFileUrl"="C:\\Program Files (x86)\\Fujitsu\DeskUpdate\\duconfig.xml"

[HKLM\SOFTWARE\Classes\CLSID\{070B64FF-795D-4DAA-88AD-6D3277C7E445}\DefaultIcon]
@=expand:"C:\\Program Files (x86)\\Fujitsu\\DeskUpdate\\DeskUpdate.exe,-0"

[HKLM\SOFTWARE\Classes\CLSID\{070B64FF-795D-4DAA-88AD-6D3277C7E445}\Shell\Open\Command]
@="C:\\Program Files (x86)\\Fujitsu\\DeskUpdate\\DeskUpdate.exe"


The last entry is a pathname with unquoted spaces and allows the
execution of the rogue programs "C:\Program.exe" and/or
"C:\Program Files.exe", as documented in
<http://msdn.microsoft.com/library/ms682425.aspx>


Stefan Kanthak

PS: long pathnames containing spaces exist for about 20 years
    now in Windows, EVERY developer should know how to use them
    properly, and EVERY QA should check their proper use!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/