Twenty Year Anniversary

Panda Global Security 17.0.1 NULL DACL Grants Full Access

Panda Global Security 17.0.1 NULL DACL Grants Full Access
Posted Mar 8, 2018
Authored by Felipe Xavier Oliveira

Panda Global Security version 17.0.1 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through the use of an insecurely created named pipe.

tags | exploit, denial of service, local
advisories | CVE-2018-6322
MD5 | 78a633d42e79810dad6911634f7b45e9

Panda Global Security 17.0.1 NULL DACL Grants Full Access

Change Mirror Download
=====[ Tempest Security Intelligence - ADV-17/2018 ]===

Panda Global Security 17.0.1 - NULL DACL grants full access
-------------------------------------------------------
Author:
- Filipe Xavier Oliveira: < filipe.xavier () tempest.com.br >

=====[ Table of Contents
]=====================================================

* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgements
* References

=====[ Overview
]==============================================================

* System affected : Panda Global Security [1]
* Software Version : 17.0.1. Other versions or models may also be affected.
* Impact : A low priveliged user can access and modify the DACL of pipe
with full access allowed. The NULL DACL grants full access to any user
that requests it; normal security checking is not performed with respect
to the object.

=====[ Detailed description
]==================================================

Panda Global Protection 17.0.1 allows local users to gain privileges or
cause a denial of service by impersonating all the pipes through a use
of \\.\pipe\PSANMSrvcPpal -- an "insecurely created named pipe."
Ensures full access to Everyone users group.

=====[ Timeline of disclosure
]===============================================

26/01/2018 - Vendor was informed of the vulnerability.
01/26/2018 - CVE assigned [2].
02/05/2018 - Vendor did not respond.
03/06/2018 - Advisory publication date.

=====[ Thanks & Acknowledgements
]============================================

- Tempest Security Intelligence / Tempest's Pentest Team [3]

=====[ References
]===========================================================

[1] - https://www.pandasecurity.com
[2] - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6322
[3] - http://www.tempest.com.br/

--
Filipe Oliveira
Tempest Security Intelligence



Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

June 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    14 Files
  • 2
    Jun 2nd
    1 Files
  • 3
    Jun 3rd
    3 Files
  • 4
    Jun 4th
    18 Files
  • 5
    Jun 5th
    21 Files
  • 6
    Jun 6th
    8 Files
  • 7
    Jun 7th
    16 Files
  • 8
    Jun 8th
    18 Files
  • 9
    Jun 9th
    5 Files
  • 10
    Jun 10th
    2 Files
  • 11
    Jun 11th
    21 Files
  • 12
    Jun 12th
    32 Files
  • 13
    Jun 13th
    15 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    4 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    2 Files
  • 18
    Jun 18th
    15 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    15 Files
  • 21
    Jun 21st
    15 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close