[NT] Checkpoint VPN-1 SecureClient Insecure Usage of CreateProcess()

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Checkpoint VPN-1 SecureClient Insecure Usage of CreateProcess()
------------------------------------------------------------------------


SUMMARY

The Microsoft Windows API "includes the
<http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/createprocess.asp> CreateProcess() function as a means to create a new process and it's primary thread".

Improper use of Windows API command CreateProcess allows attackers to
execute arbitrary programs with elevated privileges.

DETAILS

During Startup, the SR_Watchdog.exe spawns the GUI process (SR_GUI.exe)
through the use of the CreateProcess() function. By doing so it omits to
set the 'lpApplicationName' variable and further omits to quote the path
in the variable "lpCommandLine".

This results in executing c:\program.bat|exe|com prior to Sr_GUI.exe and
allow automatic startup of a potentially rogue application. In particular
one could imagine a scenario where it is possible to escalate rights using
this (as they are inherited from SR_Watchdog.exe).


ADDITIONAL INFORMATION

The information has been provided by <mailto:Thierry@xxxxxxxxx> Thierry
Zoller.
The original article can be found at:
<http://secdev.zoller.lu/research/checkpoint.txt>
http://secdev.zoller.lu/research/checkpoint.txt
The advisory about CreateProcess() can be found at:
<http://www.securiteam.com/windowsntfocus/6X00S0AELA.html>
http://www.securiteam.com/windowsntfocus/6X00S0AELA.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages