BID:29772

Deterministic Network Enhancer 'dne2000.sys' Local Privilege Escalation Vulnerability

Info

Deterministic Network Enhancer 'dne2000.sys' Local Privilege Escalation Vulnerability

Bugtraq ID:	29772
Class:	Input Validation Error
CVE:	CVE-2008-5121
Remote:	No
Local:	Yes
Published:	Jun 17 2008 12:00AM
Updated:	Apr 16 2015 05:59PM
Credit:	mu-b from Digit-Labs
Vulnerable:	Citrix Deterministic Network Enhancer 3.21.12 .17902 Citrix Deterministic Network Enhancer 3.21.8 Citrix Deterministic Network Enhancer 2.21.7 .233 + Blue Coat Systems WinProxy 6.1r1c + Blue Coat Systems WinProxy 6.1r1c + Blue Coat Systems WinProxy 6.0r1c + Blue Coat Systems WinProxy 6.0r1c + Blue Coat Systems WinProxy 2.1a + Blue Coat Systems WinProxy 2.1a + Cisco VPN Client 0 + Cisco VPN Client 0 + Cisco VPN Client for Windows 5.0.2 .0090 + Cisco VPN Client for Windows 5.0.2 .0090 + Cisco VPN Client for Windows 5.0.1 .0600 + Cisco VPN Client for Windows 5.0.1 .0600 + Cisco VPN Client for Windows 5.0.1 + Cisco VPN Client for Windows 5.0.1 + Cisco VPN Client for Windows 4.8.2 .0010 + Cisco VPN Client for Windows 4.8.2 .0010 + Cisco VPN Client for Windows 4.8.2 + Cisco VPN Client for Windows 4.8.2 + Cisco VPN Client for Windows 4.8.1 + Cisco VPN Client for Windows 4.8.1 + Cisco VPN Client for Windows 4.8 + Cisco VPN Client for Windows 4.8 + Cisco VPN Client for Windows 4.7 .0533 + Cisco VPN Client for Windows 4.7 .0533 + Cisco VPN Client for Windows 4.0.2 C + Cisco VPN Client for Windows 4.0.2 C + Cisco VPN Client for Windows 4.0.2 A + Cisco VPN Client for Windows 4.0.2 A + Cisco VPN Client for Windows 3.6.1 + Cisco VPN Client for Windows 3.6.1 + Cisco VPN Client for Windows 3.6 (Rel) + Cisco VPN Client for Windows 3.6 (Rel) + Cisco VPN Client for Windows 3.6 + Cisco VPN Client for Windows 3.6 + Cisco VPN Client for Windows 3.5.4 + Cisco VPN Client for Windows 3.5.4 + Cisco VPN Client for Windows 3.5.2 B + Cisco VPN Client for Windows 3.5.2 B + Cisco VPN Client for Windows 3.5.2 + Cisco VPN Client for Windows 3.5.2 + Cisco VPN Client for Windows 3.5.1 C + Cisco VPN Client for Windows 3.5.1 C + Cisco VPN Client for Windows 3.5.1 + Cisco VPN Client for Windows 3.5.1 + Cisco VPN Client for Windows 3.1 + Cisco VPN Client for Windows 3.1 + Cisco VPN Client for Windows 3.0.5 + Cisco VPN Client for Windows 3.0.5 + Cisco VPN Client for Windows 3.0 + Cisco VPN Client for Windows 3.0 + Cisco VPN Client for Windows 2.0 + Cisco VPN Client for Windows 2.0 + Cisco VPN Client for Windows 4.7 + Cisco VPN Client for Windows 4.7 + Cisco VPN Client for Windows 4.6 + Cisco VPN Client for Windows 4.6 + SafeNet SafeNet HighAssurance Remote 1.4 .12 + SafeNet SafeNet HighAssurance Remote 1.4 .12 + SafeNet SafeNet HighAssurance Remote 1.4 + SafeNet SafeNet HighAssurance Remote 1.4 + SafeNet SafeNet HighAssurance SafeRemote 1.4 .12 + SafeNet SafeNet HighAssurance SafeRemote 1.4 .12 + SafeNet SafeNet HighAssurance SoftRemote 1.4 + SafeNet SafeNet HighAssurance SoftRemote 1.4 + SafeNet SoftRemote + SafeNet SoftRemote + SafeNet SoftRemoteLT + SafeNet SoftRemoteLT Citrix Deterministic Network Enhancer 2.21.7 .17464 + Blue Coat Systems WinProxy 6.1r1c + Blue Coat Systems WinProxy 6.1r1c + Blue Coat Systems WinProxy 6.0r1c + Blue Coat Systems WinProxy 6.0r1c + Blue Coat Systems WinProxy 2.1a + Blue Coat Systems WinProxy 2.1a + Cisco VPN Client for Windows 5.0.2 .0090 + Cisco VPN Client for Windows 5.0.2 .0090 + Cisco VPN Client for Windows 5.0.1 .0600 + Cisco VPN Client for Windows 5.0.1 .0600 + Cisco VPN Client for Windows 5.0.1 + Cisco VPN Client for Windows 5.0.1 + Cisco VPN Client for Windows 4.8.2 .0010 + Cisco VPN Client for Windows 4.8.2 .0010 + Cisco VPN Client for Windows 4.8.2 + Cisco VPN Client for Windows 4.8.2 + Cisco VPN Client for Windows 4.8.1 + Cisco VPN Client for Windows 4.8.1 + Cisco VPN Client for Windows 4.8 + Cisco VPN Client for Windows 4.8 + Cisco VPN Client for Windows 4.7 .0533 + Cisco VPN Client for Windows 4.7 .0533 + Cisco VPN Client for Windows 4.0.2 C + Cisco VPN Client for Windows 4.0.2 C + Cisco VPN Client for Windows 4.0.2 A + Cisco VPN Client for Windows 4.0.2 A + Cisco VPN Client for Windows 3.6.1 + Cisco VPN Client for Windows 3.6.1 + Cisco VPN Client for Windows 3.6 (Rel) + Cisco VPN Client for Windows 3.6 (Rel) + Cisco VPN Client for Windows 3.6 + Cisco VPN Client for Windows 3.6 + Cisco VPN Client for Windows 3.5.4 + Cisco VPN Client for Windows 3.5.4 + Cisco VPN Client for Windows 3.5.2 B + Cisco VPN Client for Windows 3.5.2 B + Cisco VPN Client for Windows 3.5.2 + Cisco VPN Client for Windows 3.5.2 + Cisco VPN Client for Windows 3.5.1 C + Cisco VPN Client for Windows 3.5.1 C + Cisco VPN Client for Windows 3.5.1 + Cisco VPN Client for Windows 3.5.1 + Cisco VPN Client for Windows 3.1 + Cisco VPN Client for Windows 3.1 + Cisco VPN Client for Windows 3.0.5 + Cisco VPN Client for Windows 3.0.5 + Cisco VPN Client for Windows 3.0 + Cisco VPN Client for Windows 3.0 + Cisco VPN Client for Windows 2.0 + Cisco VPN Client for Windows 2.0 + Cisco VPN Client for Windows 4.7 + Cisco VPN Client for Windows 4.7 + Cisco VPN Client for Windows 4.6 + Cisco VPN Client for Windows 4.6 + SafeNet SafeNet HighAssurance Remote 1.4 .12 + SafeNet SafeNet HighAssurance Remote 1.4 .12 + SafeNet SafeNet HighAssurance Remote 1.4 + SafeNet SafeNet HighAssurance Remote 1.4 + SafeNet SafeNet HighAssurance SafeRemote 1.4 .12 + SafeNet SafeNet HighAssurance SafeRemote 1.4 .12 + SafeNet SafeNet HighAssurance SoftRemote 1.4 + SafeNet SafeNet HighAssurance SoftRemote 1.4 + SafeNet SoftRemote + SafeNet SoftRemote + SafeNet SoftRemoteLT + SafeNet SoftRemoteLT

Not Vulnerable:	Citrix Deterministic Network Enhancer 3.21.9 Cisco VPN Client for Windows 5.0.3 .0530

Discussion

Deterministic Network Enhancer 'dne2000.sys' Local Privilege Escalation Vulnerability

Deterministic Network Enhancer (DNE) is prone to a local privilege-escalation vulnerability because it fails to adequately sanitize user-supplied data.

Attackers can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful attacks will completely compromise affected computers.

DNE 'dne2000.sys' 2.21.7.233 to 3.21.8 are vulnerable; other versions may also be affected.

Affected versions of the 'dne2000.sys' driver are bundled with the following products:

SafeNet HighAssurance Remote and SoftRemote
Cisco VPN Client
WinProxy

Other products may also be affected.

Exploit / POC

Deterministic Network Enhancer 'dne2000.sys' Local Privilege Escalation Vulnerability

The following exploit code is available:

/data/vulnerabilities/exploits/29772.c

Solution / Fix

Deterministic Network Enhancer 'dne2000.sys' Local Privilege Escalation Vulnerability

Solution:
Citrix reports that DNE 3.21.9 resolves this issue. US-CERT reports that Cisco VPN Client 5.0.03.0530 for Windows resolves this issue.

Cisco is reportedly tracking this issue as Cisco Bug ID http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsm25860.

References

Deterministic Network Enhancer 'dne2000.sys' Local Privilege Escalation Vulnerability

References:

Citrix Homepage (Citrix)
CTX117751: Privilege Escalation Vulnerability in Citrix Deterministic Network En (Citrix)
Deterministic Networks, Inc. (DNI) was acquired by Citrix Systems, Inc. on March (Deterministic Networks)
Vulnerability Note VU#858993 (US-CERT)