118 lines
No EOL
4.1 KiB
Text
118 lines
No EOL
4.1 KiB
Text
|
|
Telefonica O2 Connection Manager 3.4 Local Privilege Escalation Vulnerability
|
|
|
|
|
|
Vendor: Telefonica S.A.
|
|
Product web page: http://www.telefonica.com | http://www.o2.co.uk
|
|
Affected version: 3.4.R1 (108)
|
|
|
|
Summary: O2 Connection Manager will help you to manage your internet
|
|
connections by getting you connected to the fastest available network.
|
|
Automatically connect you to the fastest available network including
|
|
your home broadband if you have a wireless router.
|
|
|
|
Desc: O2 Connection Manager suffers from an elevation of privileges
|
|
vulnerability which can be used by a simple user that can change the
|
|
executable files with a binary of choice. The vulnerability exist due
|
|
to the improper permissions, with the 'F' flag (Full) for 'Everyone'
|
|
group, making the entire directory 'O2 Connection Manager' and its
|
|
files and sub-dirs world-writable.
|
|
|
|
Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
|
Microsoft Windows 7 Ultimate SP1 (EN)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2014-5199
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5199.php
|
|
|
|
|
|
22.09.2014
|
|
|
|
---
|
|
|
|
==========================================================================
|
|
|
|
Arguments Used:
|
|
Filename = "C:\Program Files (x86)\O2CM-CE\O2 Connection Manager"
|
|
|
|
|
|
|
|
**************************************************************************
|
|
Directory: C:\Program Files (x86)\O2CM-CE\O2 Connection Manager
|
|
|
|
Permissions:
|
|
Type Username Permissions Inheritance
|
|
|
|
Allowed \Everyone Full Control This Folder Only
|
|
Allowed \Everyone Special (Unknown) Files Only
|
|
Allowed BUILTIN\Administrators Special (DCBA654321) This Folder and Files
|
|
Allowed NT SERVICE\TrustedInsta Full Control This Folder Only
|
|
Allowed NT SERVICE\TrustedInsta Special (Unknown) Subfolders only
|
|
Allowed NT AUTHORITY\SYSTEM Full Control This Folder Only
|
|
Allowed NT AUTHORITY\SYSTEM Special (Unknown) Subfolders and Files
|
|
Allowed BUILTIN\Administrators Full Control This Folder Only
|
|
Allowed BUILTIN\Administrators Special (Unknown) Subfolders and Files
|
|
Allowed BUILTIN\Users Read and Execute This Folder Only
|
|
Allowed BUILTIN\Users Special (Unknown) Subfolders and Files
|
|
Allowed \CREATOR OWNER Special (Unknown) Subfolders and Files
|
|
|
|
No Auditing set
|
|
|
|
Owner: NT AUTHORITY\SYSTEM
|
|
**************************************************************************
|
|
|
|
|
|
Operation Complete
|
|
Elapsed Time: 0,234375 seconds.
|
|
|
|
|
|
==========================================================================
|
|
|
|
Arguments Used:
|
|
Filename = "C:\Program Files (x86)\O2CM-CE\O2 Connection Manager\tscui.exe"
|
|
|
|
|
|
|
|
**************************************************************************
|
|
File: C:\Program Files (x86)\O2CM-CE\O2 Connection Manager\tscui.exe
|
|
|
|
Permissions:
|
|
Type Username Permissions Inheritance
|
|
|
|
Allowed \Everyone Full Control This Folder Only
|
|
Allowed BUILTIN\Administrators Special (DCBA654321) This Folder Only
|
|
Allowed NT AUTHORITY\SYSTEM Full Control This Folder Only
|
|
Allowed BUILTIN\Administrators Full Control This Folder Only
|
|
Allowed BUILTIN\Users Read and Execute This Folder Only
|
|
|
|
No Auditing set
|
|
|
|
Owner: NT AUTHORITY\SYSTEM
|
|
**************************************************************************
|
|
|
|
|
|
Operation Complete
|
|
Elapsed Time: 0,125 seconds.
|
|
|
|
|
|
==========================================================================
|
|
|
|
C:\Program Files (x86)\O2CM-CE\O2 Connection Manager>icacls *.exe |findstr "Everyone:(I)(F)"
|
|
Elevate.exe Everyone:(I)(F)
|
|
locSrch.exe Everyone:(I)(F)
|
|
md5sum.exe Everyone:(I)(F)
|
|
patch.exe Everyone:(I)(F)
|
|
ProfileImp.exe Everyone:(I)(F)
|
|
SupportAssistant.exe Everyone:(I)(F)
|
|
tscui.exe Everyone:(I)(F)
|
|
vcredist_x86.exe Everyone:(I)(F)
|
|
WifiProfileImportTool.exe Everyone:(I)(F)
|
|
XAU.exe Everyone:(I)(F)
|
|
|
|
C:\Program Files (x86)\O2CM-CE\O2 Connection Manager>
|
|
|
|
========================================================================== |