Vulners
Lucene search
Securepoint SSL VPN Client 2.0.30 Local Privilege Escalation
🗓️ 30 Jun 2021 00:00:00Reported by Florian BognerType 
packetstorm🔗 packetstormsecurity.com👁 159 Views
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | Securepoint SSL VPN Client 2.0.30 Local Privilege Escalation Vulnerability | 30 Jun 202100:00 | – | zdt |
 | CVE-2021-35523 | 6 Jul 202105:06 | – | circl |
 | Securepoint SSL VPN Client 访问控制错误漏洞 | 28 Jun 202100:00 | – | cnnvd |
 | Securepoint SSL VPN Client Access Control Error Vulnerability | 29 Jun 202100:00 | – | cnvd |
 | CVE-2021-35523 | 28 Jun 202116:51 | – | cve |
 | CVE-2021-35523 | 28 Jun 202116:51 | – | cvelist |
 | EUVD-2021-22159 | 7 Oct 202500:30 | – | euvd |
 | CVE-2021-35523 | 28 Jun 202117:15 | – | nvd |
 | Design/Logic Flaw | 28 Jun 202117:15 | – | prion |
 | CVE-2021-35523 | 22 May 202520:37 | – | redhatcve |
10
`Local Privilege Escalation in Securepoint SSL VPN Client 2.0.30
Metadata
===================================================
Release Date: 29-Jun-2021
Author: Florian Bogner @ https://bee-itsecurity.at
Affected product: Securepoint SSL VPN Client
Fixed in: version 2.0.32
Tested on: Windows 10 x64 fully patched
CVE: CVE-2021-35523
URL: https://bogner.sh/2021/06/local-privilege-escalation-in-securepoint-ssl-vpn-client-2-0-30/
Vulnerability Status: Fixed with new release
Vulnerability Description (copied from the CVE Details)
===================================================
Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file that is executed as privileged user.
A full vulnerability description is available here: https://bogner.sh/2021/06/local-privilege-escalation-in-securepoint-ssl-vpn-client-2-0-30/
Suggested Solution
===================================================
End-users should update to the latest available version.
Disclosure Timeline
===================================================
14.04.2021: The vulnerability was discovered and reported to [email protected]
15.04.2021: The report was triaged
26.04.2021: Securepoint SSL VPN Client Version 2.0.32 was released, which contains an initial fix for the vulnerability
23.06.2021: Securepoint SSL VPN Client Version 2.0.34 was released, which contains additional security measures.
28.06.2021: CVE-2021-35523 was assigned: https://nvd.nist.gov/vuln/detail/CVE-2021-35523
29.06.2021: Responsible disclosure in cooperation with Securepoint: https://github.com/Securepoint/openvpn-client/security/advisories/GHSA-v8p8-4w8f-qh34
___________
Florian Bogner
Information Security Expert, Speaker
Bee IT Security Consulting GmbH
Nibelungenstraße 37
3123 A-Schweinern
Mail: [email protected]
Web: https://www.bee-itsecurity.at
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
30 Jun 2021 00:00Current
0.6Low risk
Vulners AI Score0.6
EPSS0.00151