HackDig : Dig high-quality web security articles for hacker

Alienware Command Center 2.8.8.0 Local Privilege Escalation

2015-02-25 21:50
Title: Alienware Command Center 2.8.8.0 Local Privilege Escalation
Advisory ID: ZSL-2015-5229
Type: Local
Impact: Privilege Escalation
Risk: (2/5)
Release Date: 25.02.2015
Summary
Alienware Command Center is a software program developedby Alienware. The most common release is 2.8.8.0, with over 98% ofall installations currently using this version. During setup, theprogram creates a startup registration point in Windows in order toautomatically start when any user boots the PC. Upon being installed,the software adds a Windows Service which is designed to run continuouslyin the background. Manually stopping the service has been seen to causethe program to stop functing properly. It adds a background controllerservice that is set to automatically run. Delaying the start of thisservice is possible through the service manager. A scheduled task isadded to Windows Task Scheduler in order to launch the program at variousscheduled times (the schedule varies depending on the version). The primaryexecutable is named AlienFusion.exe. The setup package generally installsabout 99 files and is usually about 19.05 MB (19,979,162 bytes).
Description
The application suffers from an unquoted search path issue impactingthe service 'ioloenergybooster' for Windows deployed as part of AlienwareCommand Center. This could potentially allow an authorized but non-privilegedlocal user to execute arbitrary code with elevated privileges on the system.A successful attempt would require the local user to be able to insert theircode in the system root path undetected by the OS or other security applicationswhere it could potentially be executed during application startup or reboot.If successful, the local user’s code would execute with the elevated privilegesof the application.
Vendor
Alienware Corporation - http://www.alienware.com
Affected Version
2.8.8.0
Tested On
Microsoft Windows 8
Vendor Status
N/A
PoC
alienware_eop.txt
Credits
Vulnerability discovered by Humberto Cabrera - <humbe@zeroscience.mk>
References
N/A
Changelog
[25.02.2015] - Initial release
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk


Source: php.9225-5102-LSZ/seitilibarenluv/ne/km.ecneicsorez.www

Read:2907 | Comments:0 | Tags:No Tag

“Alienware Command Center 2.8.8.0 Local Privilege Escalation”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Announce

Share high-quality web security related articles with you:)

Tools

Tag Cloud