full-disclosure - CVE-2013-3496. Local privilege escalation vulnerability in Infotecs products (ViPNet Client\Coordinator, SafeDisk, Personal Firewall)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 21 May 2013 13:37:10 +0700
From: Максим Чудаков <chudakovma@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: CVE-2013-3496. Local privilege escalation
 vulnerability in Infotecs products (ViPNet Client\Coordinator, SafeDisk,
 Personal Firewall)

CVE-2013-3496. Local privilege escalation vulnerability in Infotecs
products (ViPNet Client\Coordinator, SafeDisk, Personal Firewall)

CVE reference:
CVE-2013-3496

Credit:
Maksim Chudakov (@MChudakov)
Andrey Kurtasanov(andreykurtasanov@...il.com)

Severity:
Medium

Local\Remote:
Local

Vulnerability Class:
Privilege Escalation

Vendor URL:
http://www.infotecs.biz/

Affected OS:
Windows

Vulnerable systems:
ViPNet Client 3.2.10 (15632) and prior
ViPNet Coordinator 3.2.10 (15632) and prior
ViPNet SafeDisk 4.1 (0.5643) and prior
VipNet Personal Firewall 3.1 and prior
Possibly same issues in other Infotecs products and other versions

Overview:
A local privilege escalation vulnerability exists in the Infotecs
products (ViPNet Client, SafeDisk, Personal Firewall and possibly
other products), which could be exploited by an attacker to execute
commands on the affected machine under the context of the SYSTEM user
or user with local administrative privileges.

Technical Background:
The vulnerability exists because Infotecs products installs to folder
with insecure permissions. "Everyone" group has "Full Control" rights
to the files/folders in the following path: "%Program
Files%\Infotecs\[product_name]". It means that any unprivileged user
can modify, delete or change permissions of any file in data the
folder consists of data, executable and configuration files.

Solution:
1) Request a patch from Vendor or
2) Go to every executable and dll file within a ViPNet folder and
change permissions manually

Disclosure Timeline:
25/03/2013 Initial vendor notification
08/04/2013 Vendor response that patches has been released
20/05/2013 Advisory released

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/