what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Serviio PRO 1.8 DLNA Media Streaming Server Local Privilege Escalation

Serviio PRO 1.8 DLNA Media Streaming Server Local Privilege Escalation
Posted May 3, 2017
Authored by LiquidWorm | Site zeroscience.mk

Serviio PRO DLNA Media Streaming Server version 1.8.0.0 PRO suffers from a local privilege escalation vulnerability.

tags | exploit, local
SHA-256 | f8106358493df1cfb4446603d58e44338173d2b26c15e0c1ab0d62fd090b082e

Serviio PRO 1.8 DLNA Media Streaming Server Local Privilege Escalation

Change Mirror Download

Serviio PRO 1.8 DLNA Media Streaming Server Local Privilege Escalation


Vendor: Petr Nejedly | Six Lines Ltd
Product web page: http://www.serviio.org
Affected version: 1.8.0.0 PRO

Summary: Serviio is a free media server. It allows you to stream your media
files (music, video or images) to renderer devices (e.g. a TV set, Bluray player,
games console or mobile phone) on your connected home network.

Desc: The application suffers from an unquoted search path issue impacting the service
'Serviio' for Windows deployed as part of Serviio DLNA server solution. This could potentially
allow an authorized but non-privileged local user to execute arbitrary code with elevated
privileges on the system. A successful attempt would require the local user to be able to
insert their code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot. If successful, the
local useras code would execute with the elevated privileges of the application.

Serviio also suffers from improper permissions which can be used by a simple authenticated user
that can change the executable file with a binary of choice. The vulnerability exist due to the
improper permissions, with the 'F' flag (Full) for 'Users' group, for the Serviio directory and
its sub-directories.


Tested on: Microsoft Windows 7 Professional SP1 (EN)
Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience


Advisory ID: ZSL-2017-5405
Advisory URL: http://www.zeroscience.mk/en/vulnerability/ZSL-2017-5405.php

SSD Advisory: https://blogs.securiteam.com/index.php/archives/3094


12.12.2016

---


C:\>sc qc Serviio
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Serviio
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\Serviio\bin\ServiioService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Serviio
DEPENDENCIES : HTTP
SERVICE_START_NAME : LocalSystem

C:\>icacls "C:\Program Files\Serviio\bin\ServiioService.exe"
C:\Program Files\Serviio\bin\ServiioService.exe BUILTIN\Users:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close