Doro PDF Writer Local Privilege Escalation Vulnerability

Bugtraq ID:	9220
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 15 2003 12:00AM
Updated:	Dec 15 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Ramon Kukla <[email protected]>.
Vulnerable:	Doro Doro PDF Writer 1.13
Not Vulnerable:	Doro Doro PDF Writer 1.15

Doro PDF Writer Local Privilege Escalation Vulnerability

Doro PDF writer has been reported prone to a vulnerability that may allow a local user to elevate privileges. The issue presents itself because, when installed, the Doro PDF writer registers a printer named 'Doro PDF Writer'. When a document is printed to this handler the print spooler calls the installed print filter. This filter is invoked with SYSTEM privileges. After Doro PDF writer has completely started a file requestor dialog with SYSTEM privileges may be available to the attacker.

Doro PDF Writer Local Privilege Escalation Vulnerability

There is no exploit code required.

Doro PDF Writer Local Privilege Escalation Vulnerability

Solution:
The vendor has released an update to address this issue:


Doro Doro PDF Writer 1.13

• Doro Doro PDF Writer Version 1.15
  http://www.geocities.com/the_real_sz/misc/doro.htm

Doro PDF Writer Local Privilege Escalation Vulnerability

References:

• Doro PDF Writer (Doro)
  
• Get admin rights using Doro (pdf creator) (Ramon Kukla )