life easier for the busy administrator. IMail Server also delivers a quick and easy installation or upgrade
process."
0x02 : Vulnerability Details
1. By default, IMail allows Internet Guest Account to have "Full Control" to the following registry key,
including its subkeys and values. As well as the default IMail directory:
HKEY_LOCAL_MACHINE\SOFTWARE\Ipswitch\IMail
C:\Program Files\Ipswitch\IMail\
2. The IMail password decryption algorithm implemented in IMailsec.dll is also reversible.
The vulnerability arises due to the mechanism used for
Inter-Process Communication (IPC) between NLNOTES and NTASKLDR.
IPC is performed via memory mapped files. When the files are
created a NULL is passed to the ACL parameter resulting in EVERYONE
being granted 'full-control'.
The result of this is that an attacker can read the contents of
any users Lotus Notes session when deployed in shared user
environments such as Terminal Services or Citrix. The data which is
accessible ranges from e-mail through to databases and associated
Scenario:
A user has enabled the Auto Local Logon option in the client, and
stored their credentials. These credentials are kept in the registry,
under HKLM\Software\Checkpoint\SecuRemote. Credentials are
specifically under the subkey named…. "Credentials"… sneaky!
Permissions for the Checkpoint key are set to Everyone – Full Control.
This means anyone with a local logon to the machine, or any
administrator from a remote machine, if remote registry access is
enabled, can view and export this key. Next step: Install the client
on another machine, and reboot as required. Configure Auto Local
Logon, and create a site, but provide no credentials. Import the key.
Prior versions may also be affected.
DETAILS
Insecure permissions have been detected in the multiple Kaspersky Lab antivirus products. “Everyone" group has “Full Control” rights to the BASES folder. The folder consists of antivirus bases, configuration files and executable modules. Local attacker (unprivileged user) can replace some files (for example, executable modules) by malicious file and execute arbitrary code with SYSTEM privileges. This is local privilege escalation vulnerability.
For example, in Kaspersky Anti-Virus 2010 (9.0.0.463) the following attack scenario could be used:
1. An attacker (unprivileged user) replaces one of the *.kdl files by malicious dynamic link library (DLL). The replacing file could be - %ALLUSERSPROFILE%\Application Data\Kaspersky Lab\AVP9\Bases\vulns.kdl.
2. Restart the system.
After restart attackers malicious DLL will be loaded with SYSTEM privileges.
Previous versions may also be affected
DETAILS
Trustport installs the own program files with insecure permissions (Everyone - Full Control). Local attacker (unprivileged user) can replace some files (including executable files of Trustport services) by malicious files and execute arbitrary code with SYSTEM privileges.
EXPLOITATION
This is local privilege escalation vulnerability. An attacker must have valid logon credentials to a system where vulnerable software is installed.
Avast! Professional Edition <= 4.8.1356
Avast! Home Edition <= 4.8.1356
DETAILS
Avast! installs some program files with insecure permissions. "Everyone" group has "Full Control" rights to the files/folders in the following path: "%Program Files%\Alwil Software\Avast4\Data". Its mean that any unprivileged user can modify, delete or change permissions of any file in DATA folder. The folder consists of data, executable and configuration files. In result multiple attack vectors are possible.
Vulnerability #1 Local privilege escalation (CVE-2009-3524)
A local attacker (unprivileged user) can modify %Program Files%\Alwil Software\Avast4\Data\avast4.ini file. "ISAPIFilter1" parameter in avast4.ini contains filename or full path to ISAPI filter module – originally "ashWsFtr.dll". An attacker can replace the original path by path to the attackers malicious dynamic library (DLL). After restart attackers DLL will be loaded with SYSTEM privileges. This is local privilege escalation vulnerability.
Previous versions may also be affected
DETAILS
Protector Plus installs the own program files with insecure permissions (Everyone - Full Control). Local attacker (unprivileged user) can replace some files (for example, executable files of Protector services) by malicious file and execute arbitary code with SYSTEM privileges. This is local privilege escalation vulnerability.
For example, the following attack scenario could be used:
1. An attacker (unprivileged user) renames one of the Protector program files (below, the FILE). For example, the FILE could be - PPAVMON.exe (Protector Plus Anti-virus Monitor Service).
2. An attacker copies his malicious executable file (with same name as the old filename of the FILE - PPAVMON.exe) to Protector folder.
3. Restart the system.
