SEC Consult Security Advisory < 20090525-3 > title: SonicWALL Global VPN Client Local Privilege Escalation Vulnerability program: SonicWALL Global VPN Client vulnerable version: Global VPN Client <= 4.0.0.835 possibly other versions homepage: http://www.sonicwall.com found: October 2006 by: lofi42 permanent link: https://www.sec-consult.com/advisories_e.html#a55 Vendor description: ------------------- The SonicWALL Global VPN Client offers an easy-to-use, easy-to-manage Virtual Private Network (VPN) solution that provides users at distributed locations with secure, reliable remote access via broadband, wireless and dial-up connections. [source: http://www.sonicwall.com/downloads/Global_VPN_DS_US.pdf] Vulnerability overview: ----------------------- A local privilege escalation vulnerability exists in SonicWALL Global VPN client. By exploiting this vulnerability, a local attacker could execute code with LocalSystem privileges. Vulnerability description: -------------------------- During installation of SonicWALL Global VPN Client permissions for installation folder "%ProgramFiles%\SonicWALL\SonicWALL Global VPN Client" by default are set to Everyone:Full Control without any warning. The Service "RampartSvc" is started from this folder. Services are started under LocalSystem account. There is no protection of service files. It's possible for unprivileged users to replace service executable with the file of his choice to get full access with LocalSystem privileges. Proof of concept: ----------------- This vulnerability can be exploited without any special exploit code. Vendor contact timeline: ------------------------ 2006: Vulnerability found 2006.10.25: Vulnerability first reported to vendor 2009.02.17: Vulnerability reported to vendor again 2009.03.16: Request for status update 2009.04.21: Request for status update 2009.05.25: Public Release Patch: ------ SEC Consult was not able to get any vendor feedback on this issue. We are currently not aware of a patch or workaround.