Advisory Url: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5229.php Alienware Command Center 2.8.8.0 Local Privilege Escalation Title: Alienware Command Center 2.8.8.0 Local Privilege Escalation Advisory ID: ZSL-2015-5229 Type: Local Impact: Privilege Escalation Risk: (2/5) Release Date: 25.02.2015 Summary Alienware Command Center is a software program developed by Alienware. The most common release is 2.8.8.0, with over 98% of all installations currently using this version. During setup, the program creates a startup registration point in Windows in order to automatically start when any user boots the PC. Upon being installed, the software adds a Windows Service which is designed to run continuously in the background. Manually stopping the service has been seen to cause the program to stop functing properly. It adds a background controller service that is set to automatically run. Delaying the start of this service is possible through the service manager. A scheduled task is added to Windows Task Scheduler in order to launch the program at various scheduled times (the schedule varies depending on the version). The primary executable is named AlienFusion.exe. The setup package generally installs about 99 files and is usually about 19.05 MB (19,979,162 bytes). Description The application suffers from an unquoted search path issue impacting the service 'ioloenergybooster' for Windows deployed as part of Alienware Command Center. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user&#8217;s code would execute with the elevated privileges of the application. Vendor Alienware Corporation - http://www.alienware.com Affected Version 2.8.8.0 Tested On Microsoft Windows 8 Vendor Status N/A PoC alienware_eop.txt Credits Vulnerability discovered by Humberto Cabrera - <humbe@zeroscience.mk> References N/A Changelog [25.02.2015] - Initial release Contact Zero Science Lab Web: http://www.zeroscience.mk e-mail: lab@zeroscience.mk