Comodo GeekBuddy < 4.18.121 - Local Privilege Escalation

• Exploit Database
• 24 阅读

• 作者： Jeremy Brown
  日期： 2015-05-20
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/37065/

• Comodo GeekBuddy Local Privilege Escalation (CVE-2014-7872)
  
  Jeremy Brown [jbrown3264/gmail]
  
  -Synopsis-
  
  Comodo GeekBuddy, which is bundled with Comodo Anti-Virus, Comodo Firewall
  and Comodo Internet Security, runs a passwordless, background VNC server
  and listens for incoming connections. This can allow for at least local
  privilege escalation on several platforms. It also may be remotely
  exploitable via CSRF-like attacks utilizing a modified web-based VNC client
  (eg. a Java VNC client).
  
  -Repro-
  
  1) Install GeekBuddy (either standalone or bundled with the aforementioned
  packages)
  2) Administrator (or other user) logs into the system so the VNC server
  will be started
  3) Start another login to the system (eg. target OS is Windows Server)
  4) Connect to the VNC server on localhost to assume the Admin session
  
  -Fix-
  
  Comodo says they have fix this vulnerability with the v4.18.121 release in
  October 2014
  
  -References-
  
  https://technet.microsoft.com/en-US/dn613815
  http://archive.hack.lu/2014/Microsoft%20Vulnerability%20Research%20-%20How%20to%20be%20a%20Finder%20as%20a%20Vendor.pdf