VentaFax System Tray Application Local Privilege Escalation Vulnerability

Bugtraq ID:	10906
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 10 2004 12:00AM
Updated:	Aug 10 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to DRWAX of the Security.NNOV group.
Vulnerable:	VentaFax VentaFax 5.4
Not Vulnerable:

VentaFax System Tray Application Local Privilege Escalation Vulnerability

It is reported that a privilege escalation vulnerability exists in the VentaFax System Tray application. The issue is due to the software starting with SYSTEM privileges, to enable access to the modem hardware, and subsequently failing to drop the privileges.

Although only VentaFax version 5.4 is reported vulnerable, it is likely that other versions are prone as well.

VentaFax System Tray Application Local Privilege Escalation Vulnerability

There is no exploit required.

VentaFax System Tray Application Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

VentaFax System Tray Application Local Privilege Escalation Vulnerability

References:

• VentaFax Homepage (VentaFax)
  
• VentaFax Privilege escalation (Security.NNOV)