Sysinternals PsTools Fails to Disconnect Share Access Allowing Local Users to Gain Administrative Access on Remote Systems
|
|
SecurityTracker Alert ID: 1010737
|
|
SecurityTracker URL: http://securitytracker.com/id?1010737
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jul 19 2004
|
Impact: Root access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 2.01, 2.02, and 2.03
|
Description: Some vulnerabilities were reported in Sysinternals PsTools. A local user can gain administrative access on certain remote hosts.
Computer Associates reported that several of the PsTools utilities map the IPC$ or ADMIN$ share when executing a command on a remote
host but do not properly disconnect from the share when the utility exits. As a result, a local user can access the share and take
administrative actions on the target system.
The following utilities are affected:
psexec 1.52, psgetsid 1.4, psinfo 1.5,
pskill 1.03, pslist 1.25, psloglist 2.5, pspasswd 1.21, psservice 2.1, psshutdown 2.31, pssuspend 1.04.
PsTools 2.01, 2.02, and
2.03 are also affected.
Alan Ridgeway of Computer Associates is credited with discovering these flaws.
|
Impact: A local user can gain administrative access on remote hosts managed by PsTools in certain cases.
|
Solution: The vendor has issued a fixed version (2.05), available at:
http://www.sysinternals.com/ntw2k/freeware/pstools.shtml
The vendor
has also issued fixes for the following components:
PsExec (1.54):
http://www.sysinternals.com/ntw2k/freeware/psexec.shtml
PsGetsid (1.41):
http://www.sysinternals.com/ntw2k/freeware/psgetsid.shtml
PsInfo (1.61):
http://www.sysinternals.com/ntw2k/freeware/psinfo.sh
tml
PsKill (use 1.03 from PsTools 2.05):
http://www.sysinternals.com/ntw2k/freeware/pskill.shtml
PsList
(1.26):
http://www.sysinternals.com/ntw2k/freeware/pslist.shtml
PsLoglist (2.51):
http://www.sysinternals.com/ntw2k/freeware/psloglist.shtml
PsPasswd (use version 1.21 from PsTools 2.05):
http://www.sysinternals.com/ntw2k/freeware/pspasswd.shtml
PsService
(2.12):
http://www.sysinternals.com/ntw2k/freeware/psservice.shtml
PsSuspend (1.05):
http://www.sysinternals.com/ntw2k/freeware/pssuspend.shtml
PsShutdown (2.32):
http://www.sysinternals.com/ntw2k/freeware/psshutdown.shtml
|
Vendor URL: www.sysinternals.com/ (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
