SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   PsTools Vendors:   Sysinternals
Sysinternals PsTools Fails to Disconnect Share Access Allowing Local Users to Gain Administrative Access on Remote Systems
SecurityTracker Alert ID:  1010737
SecurityTracker URL:  http://securitytracker.com/id/1010737
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jul 19 2004
Impact:   Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 2.01, 2.02, and 2.03
Description:   Some vulnerabilities were reported in Sysinternals PsTools. A local user can gain administrative access on certain remote hosts.

Computer Associates reported that several of the PsTools utilities map the IPC$ or ADMIN$ share when executing a command on a remote host but do not properly disconnect from the share when the utility exits. As a result, a local user can access the share and take administrative actions on the target system.

The following utilities are affected:

psexec 1.52, psgetsid 1.4, psinfo 1.5, pskill 1.03, pslist 1.25, psloglist 2.5, pspasswd 1.21, psservice 2.1, psshutdown 2.31, pssuspend 1.04.

PsTools 2.01, 2.02, and 2.03 are also affected.

Alan Ridgeway of Computer Associates is credited with discovering these flaws.

Impact:   A local user can gain administrative access on remote hosts managed by PsTools in certain cases.
Solution:   The vendor has issued a fixed version (2.05), available at:

http://www.sysinternals.com/ntw2k/freeware/pstools.shtml

The vendor has also issued fixes for the following components:

PsExec (1.54):

http://www.sysinternals.com/ntw2k/freeware/psexec.shtml

PsGetsid (1.41):

http://www.sysinternals.com/ntw2k/freeware/psgetsid.shtml

PsInfo (1.61):

http://www.sysinternals.com/ntw2k/freeware/psinfo.shtml

PsKill (use 1.03 from PsTools 2.05):

http://www.sysinternals.com/ntw2k/freeware/pskill.shtml

PsList (1.26):

http://www.sysinternals.com/ntw2k/freeware/pslist.shtml

PsLoglist (2.51):

http://www.sysinternals.com/ntw2k/freeware/psloglist.shtml

PsPasswd (use version 1.21 from PsTools 2.05):

http://www.sysinternals.com/ntw2k/freeware/pspasswd.shtml

PsService (2.12):

http://www.sysinternals.com/ntw2k/freeware/psservice.shtml

PsSuspend (1.05):

http://www.sysinternals.com/ntw2k/freeware/pssuspend.shtml

PsShutdown (2.32):

http://www.sysinternals.com/ntw2k/freeware/psshutdown.shtml

Vendor URL:  www.sysinternals.com/ (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC