Consona products uses a proprietary ActiveX site-lock mechanism that can be defeated through XSS attacks. Once an attacker can inject arbitrary JS code within the context of an allowed domain, unsafe methods can invoked to download and execute arbitrary binaries. A local privilege escalation flaw discovered in the Consona's Repair Service can be used to bypass IE8 Protected Mode, thus gaining SYSTEM privileges.
60dc5031646713bbf359f4aa1393fda67c72eb7e5d7cb4926fed44ab1fda9840
Affected products:
Consona Live Assistance
Consona Dynamic Agent
Consona Subscriber Assistance
Vulnerabilities:
-XSS
-Remote Code Execution
-Buffer Overflow
-Privilege escalation
Executive summary:
Consona products uses a propietary ActiveX site-lock mechanism that can
be defeated through XSS attacks.
Once an attacker can inject arbitrary JS code within the context of an
allowed domain, unsafe methods can invoked to download and execute
arbitrary binaries.
A local privilege escalation flaw discovered in the Consona's Repair
Service can be used to bypass IE8 Protected Mode, thus gaining SYSTEM
privileges.
The XSS flaw leds to a complete system compromise.
Technical Details:
These vulnerabilities were discovered and presented, 2 months ago, by
Ruben Santamarta at RootedCon, a security conference held in Madrid.
Slides
http://www.wintercore.com/downloads/rootedcon_0day_english.pdf
References:
[+]
http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html
[+] http://www.kb.cert.org/vuls/id/602801
[+]
http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf
--
Wintercore Iberia S.L.
C/ Castellana 122, 1ยบ Derecha
28045 MADRID - SPAIN
www.wintercore.com