BIND 9.10.5 - Unquoted Service Path Privilege Escalation Vulnerability

[+] Credits: John Page aka hyp3rlinx    
 
Vendor:
===========
www.isc.org
 
 Product:
===========
BIND9
v9.10.5 x86 / x64
 
 
BIND is open source software that enables you to publish your Domain Name System (DNS) information on the Internet, and to resolve DNS
queries for your users.  The name BIND stands for “Berkeley Internet Name Domain”, because the software originated in the early 1980s
at the University of California at Berkeley.
 
 
 
Vulnerability Type:
===================
Privilege Escalation
 
 
 
CVE Reference:
==============
CVE-2017-3141
 
 
 
Security Issue:
================
BIND installs as a service with an unquoted service path, to exploit a local attacker must place 
a malicious executable file named "Program.exe" in the path of the service, if the process runs under
some account other than the attackers it can be used to exec code under a different set of privileges.
 
 
C:\>sc qc named
[SC] QueryServiceConfig SUCCESS
 
SERVICE_NAME: named
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\ISC BIND 9\bin\named.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ISC BIND
        DEPENDENCIES       :
        SERVICE_START_NAME : .\named

#  0day.today [2018-03-12]  #