← Advisories

Alienware Command Center 2.8.8.0 Local Privilege Escalation

Low
Advisory ID
ZSL-2015-5229
Release Date
25 February 2015
Vendor
Alienware Corporation - http://www.alienware.com
Affected Version
2.8.8.0
CVE
N/A
Tested On
Microsoft Windows 8
Summary

Alienware Command Center is a software program developed by Alienware. The most common release is 2.8.8.0, with over 98% of all installations currently using this version. During setup, the program creates a startup registration point in Windows in order to automatically start when any user boots the PC. Upon being installed, the software adds a Windows Service which is designed to run continuously in the background. Manually stopping the service has been seen to cause the program to stop functing properly. It adds a background controller service that is set to automatically run. Delaying the start of this service is possible through the service manager. A scheduled task is added to Windows Task Scheduler in order to launch the program at various scheduled times (the schedule varies depending on the version). The primary executable is named AlienFusion.exe. The setup package generally installs about 99 files and is usually about 19.05 MB (19,979,162 bytes).

Description

The application suffers from an unquoted search path issue impacting the service 'ioloenergybooster' for Windows deployed as part of Alienware Command Center. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges of the application.

Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Humberto Cabrera
References
Changelog
25.02.2015Initial release
26.02.2015Added reference [1] and [2]
02.03.2015Added reference [3]