SEC Consult SA-20090525-3 :: SonicWALL Global VPN Client Local Privilege Escalation Vulnerability May 26 2009 02:47PM
Bernhard Mueller (research sec-consult com)
SEC Consult Security Advisory < 20090525-3 >
title: SonicWALL Global VPN Client Local Privilege
Escalation Vulnerability
program: SonicWALL Global VPN Client
vulnerable version: Global VPN Client <=
possibly other versions
homepage: http://www.sonicwall.com
found: October 2006
by: lofi42
permanent link: https://www.sec-consult.com/advisories_e.html#a55

Vendor description:

The SonicWALL Global VPN Client offers an easy-to-use, easy-to-manage
Virtual Private Network (VPN) solution that provides users at
distributed locations with secure, reliable remote access via broadband,
wireless and dial-up connections.

[source: http://www.sonicwall.com/downloads/Global_VPN_DS_US.pdf]

Vulnerability overview:

A local privilege escalation vulnerability exists in SonicWALL Global
VPN client. By exploiting this vulnerability, a local attacker could
execute code with LocalSystem privileges.

Vulnerability description:

During installation of SonicWALL Global VPN Client permissions for
installation folder "%ProgramFiles%\SonicWALL\SonicWALL Global VPN
Client" by default are set to Everyone:Full Control without any warning.

The Service "RampartSvc" is started from this folder. Services are
started under LocalSystem account. There is no protection of service
files. It's possible for unprivileged users to replace service
executable with the file of his choice to get full access with
LocalSystem privileges.

Proof of concept:

This vulnerability can be exploited without any special exploit code.

Vendor contact timeline:

2006: Vulnerability found
2006.10.25: Vulnerability first reported to vendor
2009.02.17: Vulnerability reported to vendor again
2009.03.16: Request for status update
2009.04.21: Request for status update
2009.05.25: Public Release


SEC Consult was not able to get any vendor feedback on this issue. We
are currently not aware of a patch or workaround.


SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com

EOF SEC Consult Vulnerability Lab / @2009

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus