F-Secure BackWeb 6.31 – Local Privilege Escalation

F-Secure BackWeb 6.31 – Local Privilege Escalation

漏洞ID 1054436 漏洞类型
发布时间 2004-04-06 更新时间 2004-04-06
图片[1]-F-Secure BackWeb 6.31 – Local Privilege Escalation-安全小百科CVE编号 N/A
图片[2]-F-Secure BackWeb 6.31 – Local Privilege Escalation-安全小百科CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/23910
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/10055/info

A vulnerability has been reported in F-Secure BackWeb that may permit local attackers to gain system level privileges. The source of this vulnerability is that certain areas within the BackWeb interface permit arbitrary programs to be invoked with LOCAL SYSTEM privileges.

The F-Secure BackWeb component appears to be included in a number of other products, including various F-Secure Anti-Virus releases, F-Secure Internet Gatekeeper and F-Secure Policy Manager. 

To reproduce on Window NT 4:

- Start BackWeb from the systray, press F1, press F1, Help about change font or color, Click on more information at the end (and view the information about the desktop), Click on the link "Screen settings", Backgound, Browse, Start CMD.EXE.

To reproduce on Windows XP:

- Create a local printer (to file), Right click on the BackWeb icon on the systray and choose "Display Channel Status", Help, Print, Add a new printer, Start explorer from any link (like "Why driver signing is imortant" or "Windows logo program"), Start CMD.EXE.

相关推荐: PHPNuke Web_Links Module Remote SQL Injection Vulnerability

PHPNuke Web_Links Module Remote SQL Injection Vulnerability 漏洞ID 1100395 漏洞类型 Input Validation Error 发布时间 2003-05-12 更新时间 2003-05-…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享