SonicWALL Global VPN Client Privilege Escalation

`SEC Consult Security Advisory < 20090525-3 >  
==========================================================================  
title: SonicWALL Global VPN Client Local Privilege  
Escalation Vulnerability   
program: SonicWALL Global VPN Client  
vulnerable version: Global VPN Client <= 4.0.0.835  
possibly other versions  
homepage: http://www.sonicwall.com  
found: October 2006  
by: lofi42  
permanent link: https://www.sec-consult.com/advisories_e.html#a55  
==========================================================================  
  
Vendor description:  
-------------------  
  
The SonicWALL Global VPN Client offers an easy-to-use, easy-to-manage  
Virtual Private Network (VPN) solution that provides users at  
distributed locations with secure, reliable remote access via broadband,  
wireless and dial-up connections.  
  
[source: http://www.sonicwall.com/downloads/Global_VPN_DS_US.pdf]  
  
  
Vulnerability overview:  
-----------------------  
  
A local privilege escalation vulnerability exists in SonicWALL Global  
VPN client. By exploiting this vulnerability, a local attacker could  
execute code with LocalSystem privileges.  
  
  
Vulnerability description:  
--------------------------  
  
During installation of SonicWALL Global VPN Client permissions for  
installation folder "%ProgramFiles%\SonicWALL\SonicWALL Global VPN  
Client" by default are set to Everyone:Full Control without any warning.  
  
The Service "RampartSvc" is started from this folder. Services are  
started under LocalSystem account. There is no protection of service  
files. It's possible for unprivileged users to replace service  
executable with the file of his choice to get full access with  
LocalSystem privileges.   
  
  
Proof of concept:  
-----------------  
  
This vulnerability can be exploited without any special exploit code.  
  
  
Vendor contact timeline:  
------------------------  
  
2006: Vulnerability found  
2006.10.25: Vulnerability first reported to vendor  
2009.02.17: Vulnerability reported to vendor again  
2009.03.16: Request for status update  
2009.04.21: Request for status update  
2009.05.25: Public Release  
  
  
Patch:  
------  
  
SEC Consult was not able to get any vendor feedback on this issue. We  
are currently not aware of a patch or workaround.  
  
  
--  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
SEC Consult Unternehmensberatung GmbH  
  
Office Vienna  
Mooslackengasse 17  
A-1190 Vienna  
Austria  
  
Tel.: +43 / 1 / 890 30 43 - 0  
Fax.: +43 / 1 / 890 30 43 - 25  
Mail: research at sec-consult dot com  
www.sec-consult.com  
  
EOF SEC Consult Vulnerability Lab / @2009  
`