Nik Sharpener Pro Insecure File Permissions Local Privilege Escalation Vulnerability
BID:27707
Info
Nik Sharpener Pro Insecure File Permissions Local Privilege Escalation Vulnerability
| Bugtraq ID: | 27707 |
| Class: | Design Error |
| CVE: |
CVE-2008-1638 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 09 2008 12:00AM |
| Updated: | May 07 2015 05:33PM |
| Credit: | Vlad Didenko <[email protected]> is credited with discovering this vulnerability. |
| Vulnerable: |
Nik Software Nik Sharpener Pro 2.0 |
| Not Vulnerable: | |
Discussion
Nik Sharpener Pro Insecure File Permissions Local Privilege Escalation Vulnerability
Nik Sharpener Pro is prone to a local privilege-escalation vulnerability that stems from a design error. This vulnerability occurs because the application assigns insecure file permissions to certain directories upon installation.
An attacker may exploit this vulnerability to overwrite files with arbitrary code in the affected directories. The arbitrary code will then run with SYSTEM-level privileges. This may facilitate a complete compromise of affected computers.
This issue affects Nik Sharpener Pro 2.0 Inkjet edition; other versions may also be vulnerable.
Nik Sharpener Pro is prone to a local privilege-escalation vulnerability that stems from a design error. This vulnerability occurs because the application assigns insecure file permissions to certain directories upon installation.
An attacker may exploit this vulnerability to overwrite files with arbitrary code in the affected directories. The arbitrary code will then run with SYSTEM-level privileges. This may facilitate a complete compromise of affected computers.
This issue affects Nik Sharpener Pro 2.0 Inkjet edition; other versions may also be vulnerable.
Exploit / POC
Nik Sharpener Pro Insecure File Permissions Local Privilege Escalation Vulnerability
An attacker can use readily available command-line tools to exploit this issue.
An attacker can use readily available command-line tools to exploit this issue.
Solution / Fix
Nik Sharpener Pro Insecure File Permissions Local Privilege Escalation Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Nik Sharpener Pro Insecure File Permissions Local Privilege Escalation Vulnerability
References:
References:
- Nik Sharpener Pro Homepage (Nik Software)