Altiris Client Service Local Privilege Escalation Vulnerability

Bugtraq ID:	13409
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 27 2005 12:00AM
Updated:	Apr 27 2005 12:00AM
Credit:	Reed Arvin <[email protected]> is credited with the discovery of this issue.
Vulnerable:	Altiris Client Service 6.0.88 Windows + Altiris Client Management Suite
Not Vulnerable:

Altiris Client Service Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability affects the Altiris Client Service. This issue is due to a failure of the application to properly secure access to privileged interfaces.

An attacker may leverage this issue to gain SYSTEM level privileges on an affected computer.

Altiris Client Service Local Privilege Escalation Vulnerability

The following exploit has been made available:

• /data/vulnerabilities/exploits/altirisClientServicePrivEscalation.c

Altiris Client Service Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Altiris Client Service Local Privilege Escalation Vulnerability

References:

• Altiris Home Page (Altiris)
  
• Privilege escalation flaw in AClient Service for Windows (Version5.6.181). (Reed Arvin )