AOL Client Software Unspecified Local Privilege Escalation Vulnerability

Bugtraq ID:	16453
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 31 2006 12:00AM
Updated:	Feb 07 2006 08:54PM
Credit:	Sudhakar Govindavajhala and Andrew Appel discovered these issues.
Vulnerable:	AOL Client Software 9.0 Security AOL Client Software 9.0 Optimized AOL Client Software 9.0 AOL Client Software 8.0 + AOL Client Software 8.0
Not Vulnerable:

AOL Client Software Unspecified Local Privilege Escalation Vulnerability

AOL Client Software is susceptible to a local privilege-escalation vulnerability. This issue is due to insecure permissions on an unspecified registry key.

This issue allows local users to execute arbitrary machine code with SYSTEM-level privileges, facilitating the complete compromise of affected computers.

AOL Client Software Unspecified Local Privilege Escalation Vulnerability

An exploit is not required.

AOL Client Software Unspecified Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

AOL Client Software Unspecified Local Privilege Escalation Vulnerability

References:

• AOL Home Page (AOL)
  
• Windows Access Control Demystified (Sudhakar Govindavajhala and Andrew W. Appel)