CVE-2006-4657

Panda Platinum Internet Security 2006 10.02.01 and 2007 11.00.00 stores service executables under the product's installation directory with weak permissions, which allows local users to obtain LocalSystem privileges by modifying 1 WebProxy.exe or 2 PAVSRV51.EXE...

CVE-2006-3697

Agnitum Outpost Firewall Pro 3.51.759.6511 462, as used in 1 Lavasoft Personal Firewall 1.0.543.5722 433 and 2 Novell BorderManager Novell Client Firewall 2.0, does not properly restrict user activities in application windows that run in a LocalSystem context, which allows local users to gain...

ntdll.dll buffer overflow via IIS 5.0 WebDAV

Added: 07/18/2006 CVE: CVE-2003-0109 BID: 7116 OSVDB: 4467 Background The dynamic link library ntdll.dll is a core component of the Windows operating system. It is used by many operating system components including the WebDAV component of Microsoft IIS. Problem A buffer overflow in ntdll.dll allo...

ntdll.dll buffer overflow via IIS 5.0 WebDAV

Added: 07/18/2006 CVE: CVE-2003-0109 BID: 7116 OSVDB: 4467 Background The dynamic link library ntdll.dll is a core component of the Windows operating system. It is used by many operating system components including the WebDAV component of Microsoft IIS. Problem A buffer overflow in ntdll.dll allo...

ntdll.dll buffer overflow via IIS 5.0 WebDAV

Added: 07/18/2006 CVE: CVE-2003-0109 BID: 7116 OSVDB: 4467 Background The dynamic link library ntdll.dll is a core component of the Windows operating system. It is used by many operating system components including the WebDAV component of Microsoft IIS. Problem A buffer overflow in ntdll.dll allo...

Re: The Weakness of Windows Impersonation Model

Hi Brian, I wrote a paper on this subject last year, "Snagging Security Tokens to Elevate Privileges" http://www.databasesecurity.com/dbsec-briefs.htm after Tim Mullen and thrashed out a few details at Blackhat last year over a few White Russians. The paper discusses the problem in the context of...

Microsoft Windows WebClient service buffer overflow

Buffer overflow on RPC based service allows code execution with LocalSystem privileges...

Symantec Antivirus / Symantec Client Security privilege escalation

With help subsystem it's possible to execute code with LocalSystem privileges...

NAePolicy.txt

Summary: Privilege escalation in Network Associates ePolicy Orchestrator Agent 3.5.0 patch 3 http://www.nai.com/ Details: The ePolicy Orchestrator Agent web server which runs on TCP port 8081 by default and serves the McAfee Agent Activity Log can be used to view files that exist on the same...

Nortel Contivity VPN Client privilege escalation

File open dialog exllows to execute file with LocalSystem privileges...

ContivitySystem.txt

Summary: Privilege escalation in Nortel Contivity VPN Client V0501.030 http://www.nortel.com Details: The Contivity VPN Client is a Windows application that lets you define and store connection information for accessing your corporate network through a Contivity Secure IP Services Gateway. When t...

[Full-disclosure] Privilege escalation in Linksys WLAN Monitor v2.0.

Summary: Privilege escalation in Linksys WLAN Monitor v2.0 http://www.linksys.com/ Details: The Linksys WLAN Monitor service WLSVC that is used to configure settings for various Linksys wireless network cards runs under the context of the LocalSystem account. It is possible to manipulate the...

Linksys WLAN Monitor privilege escalation

It's possible to execute application with LocalSystem privileges from Help system...

linksysWLAN20.txt

Summary: Privilege escalation in Linksys WLAN Monitor v2.0 http://www.linksys.com/ Details: The Linksys WLAN Monitor service WLSVC that is used to configure settings for various Linksys wireless network cards runs under the context of the LocalSystem account. It is possible to manipulate the...

Privilege escalation in Nortel Contivity VPN Client V05_01.030

Summary: Privilege escalation in Nortel Contivity VPN Client V0501.030 http://www.nortel.com Details: The Contivity VPN Client is a Windows application that lets you define and store connection information for accessing your corporate network through a Contivity Secure IP Services Gateway. When t...

[Full-disclosure] Privilege escalation and password protection bypass in Altiris Client Service for Windows (Version 6.0.88)

Summary: Privilege escalation and password protection bypass in Altiris Client Service for Windows Version 6.0.88 http://www.altiris.com/ Details: It is possible to manipulate the administrative interface of the Altiris Client Service for Windows and escalate privileges to that of the LocalSystem...

Altris deployment solution AClient privilege escalation

It's possible to launch executable with LocalSystem privileges...

Privilege escalation in BulletProof FTP Server v2.4.0.31

Summary: Privilege escalation in BulletProof FTP Server v2.4.0.31 http://www.bpftpserver.com/ Details: When the BPFTPServer service is installed and running as LocalSystem it is possible to manipulate the administrative interface and escalate privileges to that of the LocalSystem account...

BakBone NetVault 7.1 Local Privilege Escalation Exploit

Exploit for unknown platform in category local exploits ======================================================= BakBone NetVault 7.1 Local Privilege Escalation Exploit ======================================================= // ===== Start UnhideNetVaultServiceWindow.c ====== include include int...

BakBone NetVault 7.1 - Local Privilege Escalation

BakBone NetVault 7.1 - Local Privilege Escalation // ===== Start UnhideNetVaultServiceWindow.c ====== include include int main void HWND hWnd; char szWindowName = "C:\Program Files\BakBone Software\NetVault\bin\nvstatsmngr.exe"; printf "Finding window %s\n", szWindowName ; hWnd = FindWindow...