61 lines
No EOL
2.3 KiB
Text
61 lines
No EOL
2.3 KiB
Text
|
|
OpenVPN Private Tunnel Core Service Unquoted Service Path Elevation Of Privilege
|
|
|
|
|
|
Vendor: OpenVPN Technologies, Inc
|
|
Product web page: http://www.openvpn.net
|
|
Affected version: 2.1.28.0 (PrivateTunnel 2.3.8)
|
|
|
|
Summary: Private Tunnel is a new approach to true Internet security creating
|
|
a Virtual Private Tunnel (VPT) or Virtual Private Network (VPN) that encrypts,
|
|
privatizes, and protects your Internet traffic.
|
|
|
|
Desc: Private Tunnel application suffers from an unquoted search path issue
|
|
impacting the Core Service 'ptservice' service for Windows deployed as part
|
|
of PrivateTunnel bundle. This could potentially allow an authorized but
|
|
non-privileged local user to execute arbitrary code with elevated privileges
|
|
on the system. A successful attempt would require the local user to be able
|
|
to insert their code in the system root path undetected by the OS or other
|
|
security applications where it could potentially be executed during application
|
|
startup or reboot. If successful, the local user's code would execute with the
|
|
elevated privileges of the application.
|
|
|
|
Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
|
Microsoft Windows XP Professional SP3 (EN)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2014-5192
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php
|
|
|
|
|
|
07.07.2014
|
|
|
|
---
|
|
|
|
|
|
C:\Users\user>sc qc ptservice
|
|
[SC] QueryServiceConfig SUCCESS
|
|
|
|
SERVICE_NAME: ptservice
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\ptservice.exe
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : Private Tunnel Core Service
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
C:\Users\user>icacls "C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\ptservice.exe"
|
|
C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\ptservice.exe NT AUTHORITY\SYSTEM:(I)(F)
|
|
BUILTIN\Administrators:(I)(F)
|
|
BUILTIN\Users:(I)(RX)
|
|
|
|
Successfully processed 1 files; Failed processing 0 files
|
|
|
|
C:\Users\user> |