Sygate Protection Agent Local Unauthorized Access Vulnerability

Bugtraq ID:	15977
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 20 2005 12:00AM
Updated:	Dec 20 2005 12:00AM
Credit:	Mazin Faour and Andy Davis are credited with the discovery of this vulnerability.
Vulnerable:	Sygate Protection Agent 5.0 build 6144
Not Vulnerable:

Sygate Protection Agent Local Unauthorized Access Vulnerability

Sygate Protection Agent is prone to a local unauthorized access vulnerability. This issue is due to an error in the application which grants unauthorized users access to the management interface.

A local attacker can exploit this issue to disable the agent, thus removing the protection of the application; other attacks may also be possible.

Sygate Protection Agent Local Unauthorized Access Vulnerability

No exploit is required.

Sygate Protection Agent Local Unauthorized Access Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Sygate Protection Agent Local Unauthorized Access Vulnerability

References:

• Sygate Homepage (Sygate)
  
• IRM 014: Sygate Protection Agent 5.0 vulnerability - A low privileged user can ("Advisories" )