Kerio Personal Firewall Administration Menu Lets Local Users Run Applications With SYSTEM Privileges
|
|
SecurityTracker Alert ID: 1008870 |
|
SecurityTracker URL: http://securitytracker.com/id/1008870
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jan 28 2004
|
Impact:
Root access via local system
|
Exploit Included: Yes
|
Version(s): 2.x
|
Description:
Johan Tuneld reported a vulnerability in the Kerio Personal Firewall version 2.x. A local user can run commands with SYSTEM privileges.
It is reported that a local user can use the administrative menus to run a copy of 'cmd.exe' with SYSTEM level privileges. A user can go to the Administration > Miscellaneous menu, select the 'Load' button, browse to 'c:\windows\system32\cmd.exe', right-click on 'cmd.exe', and then select 'Open' to open a command window with SYSTEM privileges.
A demonstration exploit screen shot is provided at:
http://www.tuneld.com/_images/other/kpf_system_privileges.png
If a firewall password is used, the local user must be authenticated to the firewall
before exploiting this flaw.
[Editor's note: The vulnerability reportedly applies to version 2. It is not clear if more recent versions of the firewall are also affected or not.]
|
Impact:
A local user can open a Windows command window (cmd.exe) with SYSTEM privileges.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.kerio.com/kpf_home.html (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 27 Jan 2004 17:52:29 -0500
Subject: http://forums.kerio.com/index.php?t=msg&th=691&start=0&S=067cc91fff05648d31b562e7ba0cac79
|
Johan Tuneld reported a vulnerability in the Kerio Personal Firewall version 2.x. A local
user can open a command window with SYSTEM level privileges.
> Just go to Administration > Miscellaneous , select the "Load" button and browse
> to c:\windows\system32\cmd.exe ...then rightclick on cmd.exe and choose "Open".
A demonstration exploit screen shot is provided at:
http://www.tuneld.com/_images/other/kpf_system_privileges.png
If a firewall password is used, the local user must be authenticated to the firewall
before exploiting this flaw.
|
|
