Juniper VPN Client rdesktop Click Hack

`Juniper VPN client rdesktop clickhack  
================================  
discovered by [email protected]  
  
PRODUCT: Juniper VPN client + Windows remote desktop (or console access)  
  
VERSION AFFECTED: Win Vista/7 + Juniper VPN client (all versions)  
  
EXPOSURE: Remote code execution (SYSTEM privileges)  
  
SYNOPSIS  
========  
By simple clicking it is possible to spawn a  
Internet Explorer instance on rdesktop session  
before authentication.  
Account on target server is not required.  
  
PROOF OF CONCEPT  
================  
If small blue icon "network logon" is available in right down corner,  
system may be vulnerable (windows vista & 7).  
Click on the icon and keep clicking like a real power user until  
you get your explorer.  
Probably at least one VPN or Dial-UP connection must be defined.  
Illustrated guide is available at  
https://hysteria.sk/~niekt0/advisory/rdesktop_fun/  
  
WORKAROUND  
==========  
None known.  
  
VENDOR RESPONSE  
===============  
Not contacted. (try calling "helpdesk")  
  
NOTICE  
======  
It is not really clear, if this is only juniper issue.  
After third click, ale spawned screens are legitimate windows menu.  
According to some guides it should be possible to create  
"network logon" icon just by setting Windows. However,  
I was not able to do so, at least not in Windows 7 ultimate.  
  
Thanks to #brmlab, biiter  
`