55 lines
No EOL
1.9 KiB
Text
55 lines
No EOL
1.9 KiB
Text
|
||
Foxit Reader 7.0.6.1126 Unquoted Service Path Elevation Of Privilege
|
||
|
||
|
||
Vendor: Foxit Software Incorporated
|
||
Product web page: http://www.foxitsoftware.com
|
||
Affected version: 7.0.6.1126 and 6.1
|
||
|
||
Summary: Foxit Reader is a small, lightning fast, and feature rich PDF
|
||
viewer which allows you to create (free PDF creation), open, view, sign,
|
||
and print any PDF file.
|
||
|
||
Desc: The application suffers from an unquoted search path issue impacting
|
||
the service 'FoxitCloudUpdateService' for Windows deployed as part of Foxit
|
||
Reader. This could potentially allow an authorized but non-privileged local
|
||
user to execute arbitrary code with elevated privileges on the system. A
|
||
successful attempt would require the local user to be able to insert their
|
||
code in the system root path undetected by the OS or other security applications
|
||
where it could potentially be executed during application startup or reboot.
|
||
If successful, the local user’s code would execute with the elevated privileges
|
||
of the application.
|
||
|
||
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
|
||
|
||
|
||
Vulnerability discovered by Aljaz Ceru
|
||
aljaz@insec.si
|
||
|
||
|
||
Advisory ID: ZSL-2015-5235
|
||
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5235.php
|
||
|
||
Vendor: http://www.foxitsoftware.com/support/security_bulletins.php#FRD-25
|
||
|
||
|
||
17.02.2015
|
||
|
||
--
|
||
|
||
|
||
C:\Users\user>sc qc FoxitCloudUpdateService
|
||
[SC] QueryServiceConfig SUCCESS
|
||
|
||
SERVICE_NAME: FoxitCloudUpdateService
|
||
TYPE : 110 WIN32_OWN_PROCESS (interactive)
|
||
START_TYPE : 2 AUTO_START
|
||
ERROR_CONTROL : 1 NORMAL
|
||
BINARY_PATH_NAME : C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
|
||
LOAD_ORDER_GROUP :
|
||
TAG : 0
|
||
DISPLAY_NAME : Foxit Cloud Safe Update Service
|
||
DEPENDENCIES :
|
||
SERVICE_START_NAME : LocalSystem
|
||
|
||
C:\Users\user> |