Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Vuln-Dev
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Full-disclosure] Parallels Workstation - Rogue autostart..

from [Thierry Zoller] Network Security [Permanent Link]
Subject: [Full-disclosure] Parallels Workstation - Rogue autostart..
Date: Tue, 31 Oct 2006 16:31:49 +0100 

Dear List,
YARAS, Yet Another Rogue Autostart....

Below you find the mail I send to Parallel on the 23 of Septembre.

unlike stated in the text, rogue autostart also happens when
installing the application. No priviledge escalation so far so the
issue is no biggie. Still I would have liked a reaction form the
vendor.

Anyways, Parallel did not care to reply and did not fix the "bug". I
decided to post this here for everybody to know.
-- 
http://secdev.zoller.lu
Thierry Zoller

===8<=================== Original Nachrichtentext ===================


Dear Parallels Team,

I came across a small sec. issue during uninstallation of your
program. (See that screenshots attached)

The program PRLDHCP is shelled without the usage of QUOTES in the
path, leading to the execution of c:\program.exe (without elevation of
priviledges) That said it is only an issue as an auto start vector.

This might be a Macrovision issue but I don't think so.

-- 
http://secdev.zoller.lu
Thierry Zoller
===8<============== Ende des Original Nachrichtentextes =============

Attachment: Paralells_macrovision2.png
Description: PNG image

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [Full-disclosure] Parallels Workstation - Rogue autostart.., Thierry Zoller <=
Previous by Date:  [Full-disclosure] JavaScript Attack Console (Backweb), pdp (architect)
Next by Date:  phpMyConferences <= 8.0.2 Remote File Inclusion, mfp . c
Previous by Thread:  [Full-disclosure] JavaScript Attack Console (Backweb), pdp (architect)
Next by Thread:  ActiveX security leaks in the TV owned web game platform, maxgipeh
Indexes:  [Date] [Thread] [Top] [All Lists]