53 lines
No EOL
1.9 KiB
Text
53 lines
No EOL
1.9 KiB
Text
EyeLock Myris 3.3.2 SDK Service Unquoted Service Path Privilege Escalation
|
||
|
||
|
||
Vendor: EyeLock, LLC
|
||
Product web page: http://www.eyelock.com
|
||
Affected version: 3.3.21289.1311
|
||
|
||
Summary: myris® provides unparalleled security, is portable, lightweight
|
||
and is as easy as looking in a mirror. Use myris to quickly and easily
|
||
enroll users for EyeLock’s access control products or to grant users
|
||
access to corporate domain environments within seconds—users never have
|
||
to type their username and password again.
|
||
|
||
Desc: The application suffers from an unquoted search path issue impacting
|
||
the service 'MyrisService' for Windows deployed as part of Myris solution.
|
||
This could potentially allow an authorized but non-privileged local user to
|
||
execute arbitrary code with elevated privileges on the system. A successful
|
||
attempt would require the local user to be able to insert their code in the
|
||
system root path undetected by the OS or other security applications where
|
||
it could potentially be executed during application startup or reboot. If
|
||
successful, the local user’s code would execute with the elevated privileges
|
||
of the application.
|
||
|
||
Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
||
Microsoft Windows 7 Ultimate SP1 (EN)
|
||
|
||
|
||
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||
@zeroscience
|
||
|
||
|
||
Advisory ID: ZSL-2016-5355
|
||
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5355.php
|
||
|
||
|
||
10.06.2016
|
||
|
||
--
|
||
|
||
|
||
C:\Users\joxy>sc qc MyrisService
|
||
[SC] QueryServiceConfig SUCCESS
|
||
|
||
SERVICE_NAME: MyrisService
|
||
TYPE : 10 WIN32_OWN_PROCESS
|
||
START_TYPE : 2 AUTO_START
|
||
ERROR_CONTROL : 1 NORMAL
|
||
BINARY_PATH_NAME : C:\Program Files (x86)\Eyelock Corporation\MyrisSDK\bin\MyrisService.exe
|
||
LOAD_ORDER_GROUP :
|
||
TAG : 0
|
||
DISPLAY_NAME : Myris SDK Service
|
||
DEPENDENCIES :
|
||
SERVICE_START_NAME : LocalSystem |