DESlock+ 'dlpcrypt.sys' Local Privilege Escalation Vulnerability

Bugtraq ID:	35432
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 18 2009 12:00AM
Updated:	Jun 22 2009 07:19PM
Credit:	mu-b
Vulnerable:	Data Encryption Systems DESlock+ 4.0.2 Data Encryption Systems DESlock+ 3.2.7 Data Encryption Systems DESlock+ 3.2.6
Not Vulnerable:

DESlock+ 'dlpcrypt.sys' Local Privilege Escalation Vulnerability

DESlock+ is prone to a local privilege-escalation vulnerability.

An attacker may exploit this issue to execute arbitrary code with elevated privileges, which may facilitate a complete compromise of the affected computer.

DESlock+ 4.0.2 is vulnerable; other versions may also be affected.

DESlock+ 'dlpcrypt.sys' Local Privilege Escalation Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/35432.c

DESlock+ 'dlpcrypt.sys' Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

DESlock+ 'dlpcrypt.sys' Local Privilege Escalation Vulnerability

References:

• DESlock+ Homepage (Data Encryption Systems)
  
• The DESLock+ debacle (digit-labs.org)