Webroot Software Spy Sweeper Enterprise Local Privilege Escalation Vulnerability

Bugtraq ID:	12065
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 21 2004 12:00AM
Updated:	Dec 21 2004 12:00AM
Credit:	Discovery is credited to Carsten Eiram.
Vulnerable:	Webroot Spy Sweeper Enterprise 1.5.1
Not Vulnerable:	Webroot Spy Sweeper Enterprise 2.0

Webroot Software Spy Sweeper Enterprise Local Privilege Escalation Vulnerability

Spy Sweeper Enterprise is reported prone to a local privilege escalation vulnerability. This vulnerability arises due to a design error causing the software to launch a help application with SYSTEM privileges.

Spy Sweeper Enterprise 1.5.1 is reported vulnerable to this issue, however, it is possible that other versions are affected as well.

Webroot Software Spy Sweeper Enterprise Local Privilege Escalation Vulnerability

There is no exploit required.

Webroot Software Spy Sweeper Enterprise Local Privilege Escalation Vulnerability

Solution:
It is reported that Spy Sweeper Enterprise 2.0 is not affected by this vulnerability. Users are advised to upgrade to the fixed version. Please contact the vendor for more information.

Webroot Software Spy Sweeper Enterprise Local Privilege Escalation Vulnerability

References:

• Spy Sweeper Enterprise Privilege Escalation Vulnerability (Secunia)
  
• Spy Sweeper Enterprise Product Page (Webroot Software)