65 lines
No EOL
2.3 KiB
Text
65 lines
No EOL
2.3 KiB
Text
|
||
Telefonica O2 Connection Manager 8.7 Service Trusted Path Privilege Escalation
|
||
|
||
|
||
Vendor: Telefonica S.A.
|
||
Product web page: http://www.telefonica.com | http://www.o2.co.uk
|
||
Affected version: 8.7.6.792
|
||
|
||
Summary: O2 Connection Manager will help you to manage your internet
|
||
connections by getting you connected to the fastest available network.
|
||
Automatically connect you to the fastest available network including
|
||
your home broadband if you have a wireless router.
|
||
|
||
Desc: The O2 Connection Manager's service suffers from an unquoted
|
||
search path issue impacting the Import WiFi 'TGCM_ImportWiFiSvc'
|
||
service for Windows. This could potentially allow an authorized but
|
||
non-privileged local user to execute arbitrary code with elevated
|
||
privileges on the system. A successful attempt would require the
|
||
local user to be able to insert their code in the system root path
|
||
undetected by the OS or other security applications where it could
|
||
potentially be executed during application startup or reboot. If
|
||
successful, the local user’s code would execute with the elevated
|
||
privileges of the application.
|
||
|
||
Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
||
Microsoft Windows 7 Ultimate SP1 (EN)
|
||
|
||
|
||
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||
@zeroscience
|
||
|
||
|
||
Advisory ID: ZSL-2014-5200
|
||
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5200.php
|
||
|
||
|
||
22.09.2014
|
||
|
||
---
|
||
|
||
|
||
C:\>sc qc TGCM_ImportWiFiSvc
|
||
[SC] QueryServiceConfig SUCCESS
|
||
|
||
SERVICE_NAME: TGCM_ImportWiFiSvc
|
||
TYPE : 10 WIN32_OWN_PROCESS
|
||
START_TYPE : 2 AUTO_START
|
||
ERROR_CONTROL : 1 NORMAL
|
||
BINARY_PATH_NAME : C:\Program Files (x86)\O2\Connection Manager\ImpWiFiSvc.exe
|
||
LOAD_ORDER_GROUP :
|
||
TAG : 0
|
||
DISPLAY_NAME : TGCM_ImportWiFiSvc
|
||
DEPENDENCIES :
|
||
SERVICE_START_NAME : LocalSystem
|
||
|
||
C:\>icacls "C:\Program Files (x86)\O2\Connection Manager\ImpWiFiSvc.exe"
|
||
C:\Program Files (x86)\O2\Connection Manager\ImpWiFiSvc.exe NT AUTHORITY\SYSTEM:(I)(F)
|
||
BUILTIN\Administrators:(I)(F)
|
||
BUILTIN\Users:(I)(RX)
|
||
|
||
Successfully processed 1 files; Failed processing 0 files
|
||
|
||
C:\>
|
||
|
||
--- |