68 lines
No EOL
2.4 KiB
Text
68 lines
No EOL
2.4 KiB
Text
Privacyware Privatefirewall 7.0 Unquoted Service Path Privilege Escalation
|
||
|
||
|
||
Vendor: PWI, Inc.
|
||
Product web page: http://www.privacyware.com
|
||
Affected version: 7.0.30.3
|
||
|
||
|
||
Summary: Privatefirewall multi-layered endpoint security software protects
|
||
32 and 64 bit Windows desktops and servers from malware and unauthorized use.
|
||
Personal firewall, packet inspection, URL filtering, anti-logger, process
|
||
monitor, and application/system behavior modeling and anomaly detection
|
||
components stop hackers, spyware, viruses and other forms of malware before
|
||
they can cause damage.
|
||
|
||
Desc: Privatefirewall suffers from an unquoted search path issue impacting
|
||
the Core Service 'PFNet' service for Windows deployed as part of Privatefirewall
|
||
bundle. This could potentially allow an authorized but non-privileged local
|
||
user to execute arbitrary code with elevated privileges on the system. A
|
||
successful attempt would require the local user to be able to insert their
|
||
code in the system root path undetected by the OS or other security applications
|
||
where it could potentially be executed during application startup or reboot.
|
||
If successful, the local users code would execute with the elevated privileges
|
||
of the application.
|
||
|
||
Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
||
Microsoft Windows 7 Ultimate SP1 (EN)
|
||
|
||
|
||
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||
@zeroscience
|
||
|
||
|
||
Advisory ID: ZSL-2014-5209
|
||
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5209.php
|
||
|
||
|
||
09.11.2014
|
||
|
||
---
|
||
|
||
|
||
C:\Users\user>sc qc PFNet
|
||
[SC] QueryServiceConfig SUCCESS
|
||
|
||
SERVICE_NAME: PFNet
|
||
TYPE : 10 WIN32_OWN_PROCESS
|
||
START_TYPE : 2 AUTO_START
|
||
ERROR_CONTROL : 1 NORMAL
|
||
BINARY_PATH_NAME : C:\Program Files (x86)\Privacyware\Privatefirewall 7.0\pfsvc.exe
|
||
LOAD_ORDER_GROUP : TDI
|
||
TAG : 0
|
||
DISPLAY_NAME : Privacyware network service
|
||
DEPENDENCIES : RpcSs
|
||
SERVICE_START_NAME : LocalSystem
|
||
|
||
|
||
--
|
||
|
||
C:\Users\user>icacls "C:\Program Files (x86)\Privacyware\Privatefirewall 7.0\pfsvc.exe"
|
||
C:\Program Files (x86)\Privacyware\Privatefirewall 7.0\pfsvc.exe NT AUTHORITY\SYSTEM:(I)(F)
|
||
BUILTIN\Administrators:(I)(F)
|
||
BUILTIN\Users:(I)(RX)
|
||
|
||
Successfully processed 1 files; Failed processing 0 files
|
||
|
||
|
||
-- |