SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Firewall)  >   Kerio Personal Firewall Vendors:   Kerio Technologies
Kerio Personal Firewall Administration Menu Lets Local Users Run Applications With SYSTEM Privileges
SecurityTracker Alert ID:  1008870
SecurityTracker URL:  http://securitytracker.com/id/1008870
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 28 2004
Impact:   Root access via local system
Exploit Included:  Yes  
Version(s): 2.x
Description:   Johan Tuneld reported a vulnerability in the Kerio Personal Firewall version 2.x. A local user can run commands with SYSTEM privileges.

It is reported that a local user can use the administrative menus to run a copy of 'cmd.exe' with SYSTEM level privileges. A user can go to the Administration > Miscellaneous menu, select the 'Load' button, browse to 'c:\windows\system32\cmd.exe', right-click on 'cmd.exe', and then select 'Open' to open a command window with SYSTEM privileges.

A demonstration exploit screen shot is provided at:

http://www.tuneld.com/_images/other/kpf_system_privileges.png

If a firewall password is used, the local user must be authenticated to the firewall
before exploiting this flaw.

[Editor's note: The vulnerability reportedly applies to version 2. It is not clear if more recent versions of the firewall are also affected or not.]

Impact:   A local user can open a Windows command window (cmd.exe) with SYSTEM privileges.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.kerio.com/kpf_home.html (Links to External Site)
Cause:   Access control error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  http://forums.kerio.com/index.php?t=msg&th=691&start=0&S=067cc91fff05648d31b562e7ba0cac79


Johan Tuneld reported a vulnerability in the Kerio Personal Firewall version 2.x.  A local 
user can open a command window with SYSTEM level privileges.

 > Just go to Administration > Miscellaneous , select the "Load" button and browse
 > to c:\windows\system32\cmd.exe ...then rightclick on cmd.exe and choose "Open".

A demonstration exploit screen shot is provided at:

http://www.tuneld.com/_images/other/kpf_system_privileges.png

If a firewall password is used, the local user must be authenticated to the firewall 
before exploiting this flaw.

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC