81 lines
No EOL
3.8 KiB
Text
81 lines
No EOL
3.8 KiB
Text
|
|
BitRaider Streaming Client 1.3.3.4098 Local Privilege Escalation Vulnerability
|
|
|
|
|
|
Vendor: BitRaider, LLC
|
|
Product web page: http://www.bitraider.com
|
|
Affected version: 1.3.3.4098
|
|
|
|
Summary: BitRaider is a video game streaming and download service.
|
|
|
|
Desc: BitRaider contains a flaw that leads to unauthorized privileges being gained.
|
|
The issue is due to the program granting improper permissions with the 'F' flag for
|
|
the 'Users' group, which makes the entire 'BitRaider' directory and its sub directories
|
|
and files world-writable. This may allow a local attacker to change an executable file
|
|
with a binary file and gain elevated privileges.
|
|
|
|
List of executables affected:
|
|
|
|
o====================================================================================================o
|
|
| Binary/location | Description |
|
|
| | |
|
|
|=============================================================== ====================================|
|
|
| C:\ProgramData\BitRaider\BRSptStub.exe | BitRaider Support Stub |
|
|
|---------------------------------------------------------------|------------------------------------|
|
|
| C:\ProgramData\BitRaider\common\BRException.exe | BitRaider Exception Handler |
|
|
|---------------------------------------------------------------|------------------------------------|
|
|
| C:\ProgramData\BitRaider\common\brwc.exe | BitRaider Distribution Web Client |
|
|
|---------------------------------------------------------------|------------------------------------|
|
|
| C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRSptSvc.exe | BitRaider Support Service Core |
|
|
o====================================================================================================o
|
|
|
|
|
|
Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2014-5217
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5217.php
|
|
|
|
|
|
17.12.2014
|
|
|
|
----
|
|
|
|
|
|
C:\Users\user>sc qc BRSptStub
|
|
[SC] QueryServiceConfig SUCCESS
|
|
|
|
SERVICE_NAME: BRSptStub
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 3 DEMAND_START
|
|
ERROR_CONTROL : 0 IGNORE
|
|
BINARY_PATH_NAME : "C:\ProgramData\BitRaider\BRSptStub.exe"
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : BitRaider Mini-Support Service Stub Loader
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
C:\Users\user>icacls "C:\ProgramData\BitRaider\BRSptStub.exe"
|
|
C:\ProgramData\BitRaider\BRSptStub.exe BUILTIN\Users:(F) <--------------------------
|
|
NT AUTHORITY\SYSTEM:(F)
|
|
NT AUTHORITY\Authenticated Users:(F) <-------
|
|
BUILTIN\Administrators:(F)
|
|
NT AUTHORITY\INTERACTIVE:(F) <---------------
|
|
NT AUTHORITY\SERVICE:(F)
|
|
BUILTIN\Guests:(RX)
|
|
BUILTIN\Users:(I)(F) <-----------------------
|
|
NT AUTHORITY\SYSTEM:(I)(F)
|
|
NT AUTHORITY\Authenticated Users:(I)(F) <----
|
|
BUILTIN\Administrators:(I)(F)
|
|
NT AUTHORITY\INTERACTIVE:(I)(F) <------------
|
|
NT AUTHORITY\SERVICE:(I)(F)
|
|
BUILTIN\Guests:(I)(RX)
|
|
|
|
Successfully processed 1 files; Failed processing 0 files
|
|
|
|
C:\Users\user> |