KillProcess Local Privilege Escalation Vulnerability

Bugtraq ID:	14795
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 09 2005 12:00AM
Updated:	Sep 09 2005 12:00AM
Credit:	Discovery is credited to fRoGGz.
Vulnerable:	KillProcess KillProcess 2.20
Not Vulnerable:

KillProcess Local Privilege Escalation Vulnerability

KillProcess is prone to a local buffer overflow vulnerability.

A successful attack allows arbitrary machine code execution with the privileges of the user running KillProcess.

KillProcess 2.20 and prior versions are vulnerable.

KillProcess Local Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

A proof of concept is available from the following location:
http://sbox.nightmail.ru/KillProc_PoC.exe

Symantec has not verified this proof of concept.

KillProcess Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

KillProcess Local Privilege Escalation Vulnerability

References:

• KillProcess Product Page (KillProcess)
  
• KillProcess 2.20 and priors "FileDescription" Local Buffer Overflow Issue ([email protected])
  
• KillProcess 2.20 and priors "FileDescription" Local Buffer Overflow Issue ([email protected])