WehnTrust Path Specification Local Privilege Escalation Vulnerability

Bugtraq ID:	16268
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 16 2006 12:00AM
Updated:	Jan 16 2006 12:00AM
Credit:	Thierry Zoller <[email protected]> discovered this issue.
Vulnerable:	Wehnus WehnTrust
Not Vulnerable:

WehnTrust Path Specification Local Privilege Escalation Vulnerability

Wehnus WehnTrust is prone to a vulnerability that could allow an arbitrary file to be executed.

The application adds a registry key to automatically start a service upon computer restarts without using properly quoted paths. Successful exploitation may allow local attackers to gain elevated privileges.

Specific version information about affected versions of WehnTrust is unavailable at this time. This BID will be updated as further information is disclosed.

WehnTrust Path Specification Local Privilege Escalation Vulnerability

An exploit is not required.

WehnTrust Path Specification Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

WehnTrust Path Specification Local Privilege Escalation Vulnerability

References:

• WehnTrust Home Page (Wehnus)
  
• WehnTrust - When you have to trust Wehntrust (Thierry Zoller )