[VulnWatch] [ TZO-012006 ] Checkpoint VPN-1 SecureClient insecure usage of CreateProcess()



Dear List,

Title : CheckPoint - CheckQuotes!
Ref : TZO-012006-Checkpoint
Author : Thierry Zoller
TXT : http://secdev.zoller.lu/research/checkpoint.txt
URL : http://secdev.zoller.lu/research/checkpoint.htm


Introduction :
~~~~~~~~~~~~~~
As employees become more mobile, sophisticated VPN solutions are
required to meet key security challenges such as securing access
to corporate resources and protecting remote desktops. To meet the
VPN client needs of any organization, Check Point offers VPN-1
SecureClient.

Details :
~~~~~~~~~
During Startup, the SR_Watchdog.exe spawns the GUI process (SR_GUI.exe)
through the use of the CreateProcess() function. By doing so it omits
to set the 'lpApplicationName' variable and further omits to quote the
path in the variable "lpCommandLine". Ref [1]

This results in c:\program.bat|exe|com being called prior to Sr_GUI.exe
and allows automatic startup of a potentially rogue application. In
particular one could imagine a scenario where it is possible to escalate
rights using this (as they are inherited from SR_Watchdog.exe).

I decided that this is not worth to report to the vendor, I consider this
low impact in terms of Security. (Although it might show bad coding
practice).

References :
~~~~~~~~~~~~
[1] http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038789.html
[2] Only an issue on Win2k were a restricted user is allowed to write to c:\


--
http://secdev.zoller.lu
Thierry Zoller
Fingerprint : 5D84 BFDC CD36 A951 2C45 2E57 28B3 75DD 0AC6 F1C7



Relevant Pages

  • [ TZO-012006 ] Checkpoint VPN-1 SecureClient insecure usage of CreateProcess()
    ... Author: Thierry Zoller ... sophisticated VPN solutions are ... By doing so it omits ... low impact in terms of Security. ...
    (Bugtraq)
  • [Full-disclosure] [ TZO-012006 ] Checkpoint VPN-1 SecureClient insecure usage of CreateP
    ... Author: Thierry Zoller ... sophisticated VPN solutions are ... By doing so it omits ... low impact in terms of Security. ...
    (Full-Disclosure)
  • RE: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?)
    ... as a layer 7 firewall, and not compared to an IDS." ... > FREE Network Security Webinar - How to implement IPSec ... > cost-effective VPN solutions for your customers. ... FREE Network Security Webinar - How to implement IPSec security into VPN appliances ...
    (Focus-IDS)
  • Re: NIDS/NIPS implications on HSRP
    ... Cisco is doing something wrong of they depend on the line protocol failing as well as the "hello" packets being dropped. ... FREE Network Security Webinar - How to implement IPSec security into VPN appliances ... Join the security experts from SafeNet on August 26 at 1:00 PM, and learn how to successfully integrate IPSec security into VPN processors and appliances to provide powerful yet cost-effective VPN solutions for your customers. ...
    (Focus-IDS)
  • Re: Firewall vs. IPS
    ... protection_ caused by poor access control, ... FREE Network Security Webinar - How to implement IPSec security into VPN appliances ... Join the security experts from SafeNet on August 26 at 1:00 PM, and learn how to successfully integrate IPSec security into VPN processors and appliances to provide powerful yet cost-effective VPN solutions for your customers. ...
    (Focus-IDS)