SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Encryption/VPN)  >   Dell SonicWALL Vendors:   SonicWALL
SonicWALL Global VPN Client Folder Permissions Lets Local Users Gain Elevated Privileges
SecurityTracker Alert ID:  1022282
SecurityTracker URL:  http://securitytracker.com/id/1022282
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  May 27 2009
Impact:   Modification of system information, Root access via local system
Exploit Included:  Yes  
Version(s): Global VPN Client 4.0.0.835 and prior versions
Description:   A vulnerability was reported in SonicWALL Global VPN Client. A local user can obtain elevated privileges on the target system.

During installation of the SonicWALL Global VPN Client, the "%ProgramFiles%\SonicWALL\SonicWALL Global VPN Client" folder permissions are set to give "Full Control" privileges to the "Everyone" group. A local user can modify service files to include arbitrary code. Then, when the service is started, the arbitrary code will be executed with LocalSystem privileges.

The vendor was notified on October 25, 2006.

The original advisory is available at:

https://www.sec-consult.com/advisories_e.html#a55

lofi42 of SEC Consult reported this vulnerability.

Impact:   A local user can obtain LocalSystem privileges on the target system.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.sonicwall.com/ (Links to External Site)
Cause:   Access control error, Configuration error

Message History:   None.


 Source Message Contents

Subject:  SEC Consult SA-20090525-3 :: SonicWALL Global VPN Client Local

SEC Consult Security Advisory < 20090525-3 >
==========================================================================
              title: SonicWALL Global VPN Client Local Privilege
Escalation Vulnerability        
            program: SonicWALL Global VPN Client
 vulnerable version: Global VPN Client <= 4.0.0.835
                     possibly other versions
           homepage: http://www.sonicwall.com
              found: October 2006
                 by: lofi42
     permanent link: https://www.sec-consult.com/advisories_e.html#a55
==========================================================================

Vendor description:
-------------------

The SonicWALL Global VPN Client offers an easy-to-use, easy-to-manage
Virtual Private Network (VPN) solution that provides users at
distributed locations with secure, reliable remote access via broadband,
wireless and dial-up connections.

[source: http://www.sonicwall.com/downloads/Global_VPN_DS_US.pdf]


Vulnerability overview:
-----------------------

A local privilege escalation vulnerability exists in SonicWALL Global
VPN client. By exploiting this vulnerability, a local attacker could
execute code with LocalSystem privileges.


Vulnerability description:
--------------------------

During installation of SonicWALL Global VPN Client permissions for
installation folder "%ProgramFiles%\SonicWALL\SonicWALL Global VPN
Client" by default are set to Everyone:Full Control without any warning.

The Service "RampartSvc" is started from this folder. Services are
started under LocalSystem account. There is no protection of service
files. It's possible for unprivileged users to replace service
executable with the file of his choice to get full access with
LocalSystem privileges. 


Proof of concept:
-----------------

This vulnerability can be exploited without any special exploit code.


Vendor contact timeline:
------------------------

2006:       Vulnerability found
2006.10.25: Vulnerability first reported to vendor
2009.02.17: Vulnerability reported to vendor again
2009.03.16: Request for status update
2009.04.21: Request for status update
2009.05.25: Public Release


Patch:
------

SEC Consult was not able to get any vendor feedback on this issue. We
are currently not aware of a patch or workaround.


--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna
Austria

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com
www.sec-consult.com

EOF SEC Consult Vulnerability Lab / @2009

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC