Dear List, Title : CheckPoint - CheckQuotes! Ref : TZO-012006-Checkpoint Author : Thierry Zoller TXT : http://secdev.zoller.lu/research/checkpoint.txt URL : http://secdev.zoller.lu/research/checkpoint.htm Introduction : ~~~~~~~~~~~~~~ As employees become more mobile, sophisticated VPN solutions are required to meet key security challenges such as securing access to corporate resources and protecting remote desktops. To meet the VPN client needs of any organization, Check Point offers VPN-1 SecureClient. Details : ~~~~~~~~~ During Startup, the SR_Watchdog.exe spawns the GUI process (SR_GUI.exe) through the use of the CreateProcess() function. By doing so it omits to set the 'lpApplicationName' variable and further omits to quote the path in the variable "lpCommandLine". Ref [1] This results in c:\program.bat|exe|com being called prior to Sr_GUI.exe and allows automatic startup of a potentially rogue application. In particular one could imagine a scenario where it is possible to escalate rights using this (as they are inherited from SR_Watchdog.exe). I decided that this is not worth to report to the vendor, I consider this low impact in terms of Security. (Although it might show bad coding practice). References : ~~~~~~~~~~~~ [1] http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038789.html [2] Only an issue on Win2k were a restricted user is allowed to write to c:\ -- http://secdev.zoller.lu Thierry Zoller Fingerprint : 5D84 BFDC CD36 A951 2C45 2E57 28B3 75DD 0AC6 F1C7
This archive was generated by hypermail 2.1.3 : Tue Jan 17 2006 - 17:49:15 PST