BID:13925

Macromedia eLicensing Client Activation Code Local Privilege Escalation Vulnerability

Info

Macromedia eLicensing Client Activation Code Local Privilege Escalation Vulnerability

Bugtraq ID:	13925
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 09 2005 12:00AM
Updated:	Feb 07 2006 08:54PM
Credit:	The vendor announced this issue.
Vulnerable:	Macromedia Studio with Flash Professional MX 2004 Macromedia Studio MX 2004 + Macromedia ColdFusion MX 6.1 + Macromedia ColdFusion MX 6.0 + Macromedia ColdFusion MX J2EE 6.1 + Macromedia ColdFusion MX J2EE 6.0 + Macromedia ColdFusion MX J2EE 5.0 + Macromedia ColdFusion Server MX Developer + Macromedia ColdFusion Server MX 6.1 + Macromedia ColdFusion Server MX 6.0 + Macromedia Dreamweaver MX 6.1 + Macromedia Dreamweaver MX 6.0 + Macromedia Fireworks MX 2004 + Macromedia Flash MX 2004 + Macromedia Freehand MX 2004 Macromedia Freehand MX 2004 Macromedia Flash Professional MX 2004 Macromedia Flash MX 2004 Macromedia Fireworks MX 2004 Macromedia Dreamweaver MX 2004 Macromedia Director MX 2004 Macromedia Contribute 3.0 Macromedia Contribute 2.0 Macromedia Captivate

Not Vulnerable:

Discussion

Macromedia eLicensing Client Activation Code Local Privilege Escalation Vulnerability

The Macromedia installer and eLicensing client for Microsoft Windows platforms install a service ('Macromedia Licensing Service') when installing Macromedia products.

The service is a local service only; it runs with SYSTEM privileges. The vendor reports that this service is installed with insecure permissions that allow unprivileged members of the 'Users' group to make changes to the 'Macromedia Licensing Service' configuration. In making those changes, a local attacker may leverage this issue to gain SYSTEM-level access to a target computer.

Exploit / POC

Macromedia eLicensing Client Activation Code Local Privilege Escalation Vulnerability

No exploit is required.

Solution / Fix

Macromedia eLicensing Client Activation Code Local Privilege Escalation Vulnerability

Solution:
The vendor has released a hotfix to address this issue:

Macromedia Director MX 2004